0

My question is pretty short: is passlib cryptocontext verify method vulnerable to timing attacks, which would an attacker allow to narrow down the real password?

8
  • These functions have totally different functionality so you cannot move from one function to the other: one is checking if a given value fits a stored (password) hash while the other is comparing two strings with each other. And I have no idea what you are trying to do in the first place. – Steffen Ullrich Apr 11 at 20:22
  • @SteffenUllrich I edited a question – salius Apr 12 at 11:24
  • This questions still makes no sense for me. From my understanding you are basically asking if you should move from driving a car to eating an apple. And then explain that the question makes sense because in both cases something happens to you. "both have one logic: if the function returns False - I'm raising an error (invalid credentials), so it's no different for me." - If all what you need is a constant time function which can return False then just write a function which returns False and does nothing else. – Steffen Ullrich Apr 12 at 12:40
  • @SteffenUllrich anyway, please, focus on the essentials, is passlib.cryptocontext.verify vulnerable for timing attack? – salius Apr 12 at 18:29
  • In password hashing the majority of time is done in the computation of the hash and only a fraction is spend in comparing the computed hash value with the stored hash value. And even this comparison is on basically kind of random data - which have no reversible relation to the original password. This makes it impossible to even get small information about the real password from timing the process, i.e. timing attacks are infeasible to extract the password for the process in general, no matter the actual implementation. – Steffen Ullrich Apr 12 at 18:45
0

In password hashing and verification the majority of time is done in the computation of the hash. Only a small fraction of time is spend during verification for comparing the computed hash value with the stored hash value. And even this comparison is on basically comparing "randomish" data since they are the output of hash functions. And even if one could just measure the timing of the final comparison from hashed entered password to hashed stored password, it would not help to reverse engineer the original password since the hashes used are non-reversible.

In other words: timing attacks against established password hashing algorithms can not be used to determine the original password, no matter how the actual implementation is done. Additional protection against timing attacks in the implementations is not needed.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.