arduino/esp8266
1
0
Fork 0
mirror of https://github.com/esp8266/Arduino.git synced 2025-07-17 12:02:15 +03:00
Code Activity

Added constant time string comparison to avoid possible time-based attacks. (#3836)

Browse Source 
* Added constant time strings comparison to avoid possible time-based attacks

* Fixed data types

* Fixed indentation

* Moved string comnparison in constant time to String class; modified function body to assure constant time comparison despite compiler optimizations

* Removed wrong code

* Fixed error and prevented compiler optimization to delete u1 local variable

* Avoid timing attacks on string comparison

* Minor

* changed counter names, removed else
This commit is contained in:
Alessio Leoncini
2017-11-21 05:56:05 +01:00
committed by Develo
parent cbfbc1ad63
commit 03f1a540ca
4 changed files with 30 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

27
cores/esp8266/WString.cpp
View File

@ -477,6 +477,33 @@ unsigned char String::equalsIgnoreCase(const String &s2) const {
return 1;
}
unsigned char String::equalsConstantTime(const String &s2) const {
// To avoid possible time-based attacks present function
// compares given strings in a constant time.
if(len != s2.len)
return 0;
//at this point lengths are the same
if(len == 0)
return 1;
//at this point lenghts are the same and non-zero
const char *p1 = buffer;
const char *p2 = s2.buffer;
unsigned int equalchars = 0;
unsigned int diffchars = 0;
while(*p1) {
if(*p1 == *p2)
++equalchars;
else
++diffchars;
++p1;
++p2;
}
//the following should force a constant time eval of the condition without a compiler "logical shortcut"
unsigned char equalcond = (equalchars == len);
unsigned char diffcond = (diffchars == 0);
return (equalcond & diffcond); //bitwise AND
}
unsigned char String::startsWith(const String &s2) const {
if(len < s2.len)
return 0;