3 added 4 characters in body
source | link

Rather than giving the application direct access to the hashes so that it check the password, I'd like to delegate this to the database system itself.

Why do you want to delegate it? Simply It's simpler to just fetch the hash for the username given, and do a constant side string comparison (using pseudo-code above) with the fetched hash?.

Every successful login will give the web application running on your server both the entered password as well as the computed hash of the password.

Depending on your databaseGranted what you could writewant is fairly straightforward to do within for a constant time string comparison routine, but it seems overly complicated. E.ggiven database using its procedural langauge (PL). For example, in postgres with plpgsqlyou could write:

CREATE OR REPLACE FUNCTION user_with_correct_hash(username TEXT, app_hash TEXT) RETURNS BOOLEAN AS
$$
DECLARE
    user_hash TEXT;
BEGIN
    user_hash := SELECT hash FROM users WHERE "name" = username;
    IF (user_hash IS NULL) THEN
        RETURN false;
    END IF;
    RETURN constant_time_string_compare(user_hash, app_hash);
END
$$
LANGUAGE plpgsql;


CREATE OR REPLACE FUNCTION constant_time_string_compare(user_hash TEXT, app_hash TEXT) RETURNS BOOLEAN AS
$$
DECLARE
    result INTEGER;
    index INTEGER;
    hash_length INTEGER;
BEGIN 
    hash_length := (SELECT CHAR_LENGTH(app_hash));
    IF CHAR_LENGTH(user_hash) != hash_length THEN
        RETURN false;
    END IF;
    index := 1;
    result := 0;
    WHILE index <= hash_length LOOP
        result := (SELECT result | (ascii(substr(app_hash, index, 1)) # ascii(substr(user_hash, index), 1)));
        index := (SELECT index + 1);1;
    END LOOP;
    RETURN (result = 0);
END
$$
LANGUAGE plpgsql;

Granted be very careful to give your constant time string comparison several test cases to make sure it is behaving properly.

Rather than giving the application direct access to the hashes so that it check the password, I'd like to delegate this to the database system itself.

Why do you want to delegate it? Simply fetch the hash for the username given, and do a constant side string comparison (using pseudo-code above) with the fetched hash?

Every successful login will give the web application running on your server both the entered password as well as the computed hash of the password.

Depending on your database you could write a constant time string comparison routine, but it seems overly complicated. E.g., in postgres with plpgsql:

CREATE OR REPLACE FUNCTION user_with_correct_hash(username TEXT, app_hash TEXT) RETURNS BOOLEAN AS
$$
DECLARE
    user_hash TEXT;
BEGIN
    user_hash := SELECT hash FROM users WHERE "name" = username;
    IF (user_hash IS NULL) THEN
        RETURN false;
    END IF;
    RETURN constant_time_string_compare(user_hash, app_hash);
END
$$
LANGUAGE plpgsql;


CREATE OR REPLACE FUNCTION constant_time_string_compare(user_hash TEXT, app_hash TEXT) RETURNS BOOLEAN AS
$$
DECLARE
    result INTEGER;
    index INTEGER;
    hash_length INTEGER;
BEGIN 
    hash_length := (SELECT CHAR_LENGTH(app_hash));
    IF CHAR_LENGTH(user_hash) != hash_length THEN
        RETURN false;
    END IF;
    index := 1;
    result := 0;
    WHILE index <= hash_length LOOP
        result := (SELECT result | (ascii(substr(app_hash, index)) # ascii(substr(user_hash, index))));
        index := (SELECT index + 1);
    END LOOP;
    RETURN (result = 0);
END
$$
LANGUAGE plpgsql;

Granted be very careful to give your constant time string comparison several test cases to make sure it is behaving properly.

Rather than giving the application direct access to the hashes so that it check the password, I'd like to delegate this to the database system itself.

Why do you want to delegate it? It's simpler to just fetch the hash for the username given, and do a constant side string comparison (using pseudo-code above) with the fetched hash.

Every successful login will give the web application running on your server both the entered password as well as the computed hash of the password.

Granted what you want is fairly straightforward to do within for a given database using its procedural langauge (PL). For example, in postgres you could write:

CREATE OR REPLACE FUNCTION user_with_correct_hash(username TEXT, app_hash TEXT) RETURNS BOOLEAN AS
$$
DECLARE
    user_hash TEXT;
BEGIN
    user_hash := SELECT hash FROM users WHERE "name" = username;
    IF (user_hash IS NULL) THEN
        RETURN false;
    END IF;
    RETURN constant_time_string_compare(user_hash, app_hash);
END
$$
LANGUAGE plpgsql;


CREATE OR REPLACE FUNCTION constant_time_string_compare(user_hash TEXT, app_hash TEXT) RETURNS BOOLEAN AS
$$
DECLARE
    result INTEGER;
    index INTEGER;
    hash_length INTEGER;
BEGIN 
    hash_length := CHAR_LENGTH(app_hash);
    IF CHAR_LENGTH(user_hash) != hash_length THEN
        RETURN false;
    END IF;
    index := 1;
    result := 0;
    WHILE index <= hash_length LOOP
        result := result | (ascii(substr(app_hash, index, 1)) # ascii(substr(user_hash, index, 1)));
        index := index + 1;
    END LOOP;
    RETURN (result = 0);
END
$$
LANGUAGE plpgsql;

Granted be very careful to give your constant time string comparison several test cases to make sure it is behaving properly.

2 added 4 characters in body
source | link

Rather than giving the application direct access to the hashes so that it check the password, I'd like to delegate this to the database system itself.

Why do you want to delegate it? Simply fetch the hash for the username given, and do a constant side string comparison (using pseudo-code above) with the fetched hash?

Every successful login will give the web application running on your server both the entered password as well as the computed hash of the password.

Depending on your database you could write a constant time string comparison routine, but it seems overly complicated. E.g., in postgres with plpgsql:

CREATE OR REPLACE FUNCTION user_with_correct_hash(username TEXT, app_hash TEXT) RETURNS BOOLEAN AS
$$
DECLARE
    user_hash TEXT;
BEGIN
    user_hash := SELECT hash FROM users WHERE "name" = username;
    IF (user_hash IS NULL) THEN
        RETURN false;
    END IF;
    RETURN constant_time_string_compare(user_hash, app_hash);
END
$$
LANGUAGE plpgsql;


CREATE OR REPLACE FUNCTION constant_time_string_compare(user_hash TEXT, app_hash TEXT) RETURNS BOOLEAN AS
$$
DECLARE
    result INTEGER;
    index INTEGER;
    hash_length INTEGER;
BEGIN 
    hash_length := (SELECT CHAR_LENGTH(app_hash));
    IF CHAR_LENGTH(user_hash) != hash_length THEN
        RETURN false;
    END IF;
    index := 1;
    result := 0;
    WHILE index <= hash_length LOOP
        result := (SELECT (result | (ascii(substr(app_hash, index)) # ascii(substr(user_hash, index))));
        index := (SELECT index + 1);
    END LOOP;
    RETURN (result = 0);
END
$$
LANGUAGE plpgsql;

Granted be very careful to give your constant time string comparison several test cases to make sure it is behaving properly.

Rather than giving the application direct access to the hashes so that it check the password, I'd like to delegate this to the database system itself.

Why do you want to delegate it? Simply fetch the hash for the username given, and do a constant side string comparison (using pseudo-code above) with the fetched hash?

Every successful login will give the web application running on your server both the entered password as well as the computed hash of the password.

Depending on your database you could write a constant time string comparison routine, but it seems overly complicated. E.g., in postgres with plpgsql:

CREATE OR REPLACE FUNCTION user_with_correct_hash(username TEXT, app_hash TEXT) RETURNS BOOLEAN AS
$$
DECLARE
    user_hash TEXT;
BEGIN
    user_hash := SELECT hash FROM users WHERE "name" = username;
    IF (user_hash IS NULL) THEN
        RETURN false;
    END IF;
    RETURN constant_time_string_compare(user_hash, app_hash);
END
$$
LANGUAGE plpgsql;


CREATE OR REPLACE FUNCTION constant_time_string_compare(user_hash TEXT, app_hash TEXT) RETURNS BOOLEAN AS
$$
DECLARE
    result INTEGER;
    index INTEGER;
    hash_length INTEGER;
BEGIN 
    hash_length := (SELECT CHAR_LENGTH(app_hash));
    IF CHAR_LENGTH(user_hash) != hash_length THEN
        RETURN false;
    END IF;
    index := 1;
    result := 0;
    WHILE index <= hash_length LOOP
        result := (SELECT (result | ascii(substr(app_hash, index)) # ascii(substr(user_hash, index))));
        index := (SELECT index + 1);
    END LOOP;
    RETURN (result = 0);
END
$$
LANGUAGE plpgsql;

Rather than giving the application direct access to the hashes so that it check the password, I'd like to delegate this to the database system itself.

Why do you want to delegate it? Simply fetch the hash for the username given, and do a constant side string comparison (using pseudo-code above) with the fetched hash?

Every successful login will give the web application running on your server both the entered password as well as the computed hash of the password.

Depending on your database you could write a constant time string comparison routine, but it seems overly complicated. E.g., in postgres with plpgsql:

CREATE OR REPLACE FUNCTION user_with_correct_hash(username TEXT, app_hash TEXT) RETURNS BOOLEAN AS
$$
DECLARE
    user_hash TEXT;
BEGIN
    user_hash := SELECT hash FROM users WHERE "name" = username;
    IF (user_hash IS NULL) THEN
        RETURN false;
    END IF;
    RETURN constant_time_string_compare(user_hash, app_hash);
END
$$
LANGUAGE plpgsql;


CREATE OR REPLACE FUNCTION constant_time_string_compare(user_hash TEXT, app_hash TEXT) RETURNS BOOLEAN AS
$$
DECLARE
    result INTEGER;
    index INTEGER;
    hash_length INTEGER;
BEGIN 
    hash_length := (SELECT CHAR_LENGTH(app_hash));
    IF CHAR_LENGTH(user_hash) != hash_length THEN
        RETURN false;
    END IF;
    index := 1;
    result := 0;
    WHILE index <= hash_length LOOP
        result := (SELECT result | (ascii(substr(app_hash, index)) # ascii(substr(user_hash, index))));
        index := (SELECT index + 1);
    END LOOP;
    RETURN (result = 0);
END
$$
LANGUAGE plpgsql;

Granted be very careful to give your constant time string comparison several test cases to make sure it is behaving properly.

1
source | link

Rather than giving the application direct access to the hashes so that it check the password, I'd like to delegate this to the database system itself.

Why do you want to delegate it? Simply fetch the hash for the username given, and do a constant side string comparison (using pseudo-code above) with the fetched hash?

Every successful login will give the web application running on your server both the entered password as well as the computed hash of the password.

Depending on your database you could write a constant time string comparison routine, but it seems overly complicated. E.g., in postgres with plpgsql:

CREATE OR REPLACE FUNCTION user_with_correct_hash(username TEXT, app_hash TEXT) RETURNS BOOLEAN AS
$$
DECLARE
    user_hash TEXT;
BEGIN
    user_hash := SELECT hash FROM users WHERE "name" = username;
    IF (user_hash IS NULL) THEN
        RETURN false;
    END IF;
    RETURN constant_time_string_compare(user_hash, app_hash);
END
$$
LANGUAGE plpgsql;


CREATE OR REPLACE FUNCTION constant_time_string_compare(user_hash TEXT, app_hash TEXT) RETURNS BOOLEAN AS
$$
DECLARE
    result INTEGER;
    index INTEGER;
    hash_length INTEGER;
BEGIN 
    hash_length := (SELECT CHAR_LENGTH(app_hash));
    IF CHAR_LENGTH(user_hash) != hash_length THEN
        RETURN false;
    END IF;
    index := 1;
    result := 0;
    WHILE index <= hash_length LOOP
        result := (SELECT (result | ascii(substr(app_hash, index)) # ascii(substr(user_hash, index))));
        index := (SELECT index + 1);
    END LOOP;
    RETURN (result = 0);
END
$$
LANGUAGE plpgsql;