Skip to content

hmac.secure_compare() leaks information about length of strings #59266

@tiran

Description

@tiran
BPO 15061
Nosy @loewis, @birkenfeld, @gpshead, @ncoghlan, @pitrou, @tiran, @alex, @akheron, @hynek, @serhiy-storchaka
Files
  • secure_compare_length.patch
  • timingsafe.h
  • timingsafe_cmp.patch
  • timingsafe_cmp-2.patch
  • compare_digest_c.patch
  • compare_digest_c-2.patch
  • Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.

    Show more details

    GitHub fields:

    assignee = None
    closed_at = <Date 2012-06-24.13:12:05.157>
    created_at = <Date 2012-06-13.23:00:23.931>
    labels = ['type-security', 'library']
    title = 'hmac.secure_compare() leaks information about length of strings'
    updated_at = <Date 2012-06-24.13:12:05.156>
    user = 'https://github.com/tiran'

    bugs.python.org fields:

    activity = <Date 2012-06-24.13:12:05.156>
    actor = 'christian.heimes'
    assignee = 'none'
    closed = True
    closed_date = <Date 2012-06-24.13:12:05.157>
    closer = 'christian.heimes'
    components = ['Library (Lib)']
    creation = <Date 2012-06-13.23:00:23.931>
    creator = 'christian.heimes'
    dependencies = []
    files = ['26003', '26068', '26079', '26106', '26112', '26120']
    hgrepos = []
    issue_num = 15061
    keywords = ['patch', 'needs review']
    message_count = 96.0
    messages = ['162739', '162758', '162759', '162760', '162761', '162762', '162763', '162764', '162765', '162766', '162767', '162768', '162769', '162770', '162773', '162775', '162777', '162778', '162838', '162845', '162846', '162847', '162848', '162850', '162852', '162853', '162855', '162856', '162857', '162858', '162859', '162860', '162861', '162862', '162863', '162864', '162865', '162866', '162867', '162868', '162871', '162872', '162873', '162875', '162877', '162880', '162882', '162885', '162888', '162891', '162892', '162893', '162895', '162899', '162914', '162949', '162950', '163159', '163163', '163168', '163170', '163186', '163188', '163192', '163193', '163196', '163204', '163329', '163333', '163343', '163347', '163365', '163366', '163368', '163371', '163377', '163378', '163385', '163390', '163468', '163469', '163613', '163614', '163615', '163617', '163619', '163623', '163625', '163626', '163627', '163630', '163652', '163671', '163696', '163780', '163784']
    nosy_count = 13.0
    nosy_names = ['loewis', 'georg.brandl', 'gregory.p.smith', 'ncoghlan', 'pitrou', 'christian.heimes', 'alex', 'fijall', 'python-dev', 'petri.lehtinen', 'hynek', 'serhiy.storchaka', 'Jon.Oberheide']
    pr_nums = []
    priority = 'normal'
    resolution = 'fixed'
    stage = 'resolved'
    status = 'closed'
    superseder = None
    type = 'security'
    url = 'https://bugs.python.org/issue15061'
    versions = ['Python 3.3']

    Metadata

    Metadata

    Assignees

    No one assigned

      Labels

      stdlibStandard Library Python modules in the Lib/ directorytype-securityA security issue

      Projects

      No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions