Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Change timingSafeEqual to use byteLength. #21397

Closed
wants to merge 4 commits into from
Closed

Change timingSafeEqual to use byteLength. #21397

wants to merge 4 commits into from

Commits on Jun 19, 2018

  1. Change timingSafeEqual to use byteLength.

    Former implementation of `timingSafeEqual` would allow different length; allowing a core dump.
    
    ```shell
    [zeen3@zeen3 ~]$ node
    Running node v10.4.1 (npm v6.1.0)
    > crypto.timingSafeEqual(new BigUint64Array(32), new Uint32Array(32))
    node[16304]: ../src/node_crypto.cc:5158:void node::crypto::TimingSafeEqual(const v8::FunctionCallbackInfo<v8::Value>&): Assertion `(buf_length) == (Buffer::Length(args[1]))' failed.
     1: node::Abort() [node]
     2: 0x8938b5 [node]
     3: 0x97212a [node]
     4: 0xb00989 [node]
     5: v8::internal::Builtin_HandleApiCall(int, v8::internal::Object**, v8::internal::Isolate*) [node]
     6: 0x2dbaff1841bd
    Aborted (core dumped)
    [zeen3@zeen3 ~]$ node
    Running node v10.4.1 (npm v6.1.0)
    > crypto.timingSafeEqual(new BigUint64Array(32), new Uint32Array(64))
    RangeError [ERR_CRYPTO_TIMING_SAFE_EQUAL_LENGTH]: Input buffers must have the same length
        at Object.timingSafeEqual (internal/crypto/util.js:81:11)
    > crypto.timingSafeEqual(new BigUint64Array(32), new Uint32Array(32))
    node[16856]: ../src/node_crypto.cc:5158:void node::crypto::TimingSafeEqual(const v8::FunctionCallbackInfo<v8::Value>&): Assertion `(buf_length) == (Buffer::Length(args[1]))' failed.
     1: node::Abort() [node]
     2: 0x8938b5 [node]
     3: 0x97212a [node]
     4: 0xb00989 [node]
     5: v8::internal::Builtin_HandleApiCall(int, v8::internal::Object**, v8::internal::Isolate*) [node]
     6: 0x128c0a5041bd
    Aborted (core dumped)
    [zeen3@zeen3 ~]$ 
    ```
    
    Though unlikely to occur it's possible.
    ZaneHannanAU authored Jun 19, 2018
    Configuration menu
    Copy the full SHA
    72f2156 View commit details
    Browse the repository at this point in the history
  2. Update test-crypto-timing-safe-equal.js

    Add various modern ArrayBuffer based timingSafeEqual variants.
    ZaneHannanAU authored Jun 19, 2018
    Configuration menu
    Copy the full SHA
    90ff08f View commit details
    Browse the repository at this point in the history
  3. Update test-crypto-timing-safe-equal.js

    Linter length < 80
    Fix one issue where I wrote the wrong amount of tests.
    ZaneHannanAU authored Jun 19, 2018
    Configuration menu
    Copy the full SHA
    6eba5d0 View commit details
    Browse the repository at this point in the history

Commits on Jun 26, 2018

  1. More descriptive errors if it does error this time.

    ... please don't error this time. You have no reason to.
    ZaneHannanAU authored Jun 26, 2018
    Configuration menu
    Copy the full SHA
    06a4f4f View commit details
    Browse the repository at this point in the history