Java: Timing attacks while comparing results of cryptographic operations#6006

Merged

smowton merged 31 commits intogithub:mainfrom

artem-smotrakov:timing-attacks

Aug 9, 2021

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Java: Timing attacks while comparing results of cryptographic operations#6006

Java: Timing attacks while comparing results of cryptographic operations#6006
smowton merged 31 commits intogithub:mainfrom
artem-smotrakov:timing-attacks

Commits on Aug 1, 2021

Java: Added a query for timing attacks

Added tests for NotConstantTimeCryptoComparison.ql

Added NotConstantTimeCryptoComparison.qhelp and examples

Removed hashes from NotConstantTimeCryptoComparison.ql

Better comments and descriptions

Covered Object.deepEquals() in NotConstantTimeCryptoComparison.ql

Covered Arrays.deepEquals() in NonConstantTimeCryptoComparison.ql

Renamed files

More sinks for java/ql/src/experimental/Security/CWE/CWE-208/NonConstantTimeCryptoComparison.ql

Take into account remote user input in java/non-constant-time-crypto-comparison

Added more taint propagation steps for InputStream and ByteBuffer

Less duplicate code in java/non-constant-time-crypto-comparison

Better constant check in java/non-constant-time-crypto-comparison

Make java/non-constant-time-crypto-comparison a warning

More test cases for java/non-constant-time-crypto-comparison

Better docs for java/non-constant-time-crypto-comparison

Added a change note for new steps for ByteBuffer and InputStream

Better signatures in java/non-constant-time-crypto-comparison

More references in NonConstantTimeCryptoComparison.qhelp

Covered custom fast-fail checks in NonConstantTimeCryptoComparison.ql

Added taint propagation steps for hashes in NonConstantTimeCryptoComparison.ql

Consider only Cipher.ENCRYPT_MODE in NonConstantTimeCryptoComparison.ql

Narrow NonConstantTimeCryptoComparison.ql to timing attack on signatures and MACs only

Renamed NonConstantTimeCryptoComparison.ql to NonConstantTimeCheckOnSignature.ql

Two queries for timing attacks

Apply suggestions from code review

Better qhelp for timing attacks

Removed unsafeMacCheckWithArraysDeepEquals() test

Better qldoc for timing attacks

Commits on Aug 4, 2021

Renamed queries and merged qhelp files

Commits on Aug 9, 2021

Fix test reference and expectations

Java: Timing attacks while comparing results of cryptographic operations#6006smowton merged 31 commits intogithub:maingithub/codeql:mainfrom artem-smotrakov:timing-attacksartem-smotrakov/ql:timing-attacksCopy head branch name to clipboard

Commits

Commits on Aug 1, 2021

Commits on Aug 4, 2021

Commits on Aug 9, 2021

Java: Timing attacks while comparing results of cryptographic operations#6006
smowton merged 31 commits intogithub:mainfrom
artem-smotrakov:timing-attacks