MyFavMirrors/minio
1
0
Fork 0
mirror of https://github.com/minio/minio.git synced 2025-11-09 13:39:46 -05:00
Code Issues Packages Projects Releases Wiki Activity

fix timing oracle attack against signature V2/V4 verification (#5335)

Browse Source 
This change replaces the non-constant time comparison of
request signatures with a constant time implementation. This
prevents a timing attack which can be used to learn a valid 
signature for a request without knowing the secret key.

Fixes #5334
This commit is contained in:
Andreas Auernhammer
2018-01-02 07:30:02 +01:00
committed by Nitish Tiwari
parent e39d7ddb0f
commit a6318dbdaf
4 changed files with 52 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
cmd/signature-v4-parser_test.go
View File

@@ -427,7 +427,7 @@ func TestParseSignV4(t *testing.T) {
validateCredentialfields(t, i+1, testCase.expectedAuthField.Credential, parsedAuthField.Credential)
// validating the extraction/parsing of signature field.
if testCase.expectedAuthField.Signature != parsedAuthField.Signature {
if !compareSignatureV4(testCase.expectedAuthField.Signature, parsedAuthField.Signature) {
t.Errorf("Test %d: Parsed Signature field mismatch: Expected \"%s\", got \"%s\"", i+1, testCase.expectedAuthField.Signature, parsedAuthField.Signature)
}
@@ -795,7 +795,7 @@ func TestParsePreSignV4(t *testing.T) {
t.Errorf("Test %d: Expected the result to be \"%v\", but got \"%v\". ", i+1, testCase.expectedPreSignValues.SignedHeaders, parsedPreSign.SignedHeaders)
}
// validating signature field.
if testCase.expectedPreSignValues.Signature != parsedPreSign.Signature {
if !compareSignatureV4(testCase.expectedPreSignValues.Signature, parsedPreSign.Signature) {
t.Errorf("Test %d: Signature field mismatch: Expected \"%s\", got \"%s\"", i+1, testCase.expectedPreSignValues.Signature, parsedPreSign.Signature)
}
// validating expiry duration.