Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Consistently use constant-time comparison of password hashes instead of bare password strings #7455

Merged
merged 1 commit into from
May 9, 2023
Merged

Consistently use constant-time comparison of password hashes instead of bare password strings #7455

merged 1 commit into from
May 9, 2023

Commits on May 8, 2023

  1. Consistently use constant-time comparison of password hashes 

    As per golang/go#47001 even subtle.ConstantTimeCompare should never be used with variable-length inputs, as it will return 0 if the lengths do not match. Switch to consistently using constant-time comparisons of hashes for password checks to avoid any possible side-channel leaks that could be combined with other vectors to discover password lengths.

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
    @brandond
    brandond committed May 8, 2023
    Configuration menu
    Copy the full SHA
    840ddeb View commit details
    Browse the repository at this point in the history