mirror of
https://github.com/sigoden/dufs.git
synced 2026-06-07 23:16:54 +03:00
[GH-ISSUE #228] Is authentication done in constant time for Basic Authentication ? #4928
Assignees
zhus (Sergey Zhukov)
Clear assignees
zhus (Sergey Zhukov)
No Assignees
Notifications
Due Date
No due date set.
Dependencies
No dependencies set.
Reference: sigoden/dufs#4928
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @perrinjerome on GitHub (Jun 2, 2023).
Original GitHub issue: https://github.com/sigoden/dufs/issues/228
Problem
If I understand correctly, when running with
--auth-method basic, thishttps://github.com/sigoden/dufs/blob/4f3a8d275b7f2904ec2e16a0a8e54e4a9bec1986/src/auth.rs#L309-L315
is not comparing the password using constant time, which is not recommended according to
https://cheatsheetseries.owasp.org/cheatsheets/Authentication_Cheat_Sheet.html#compare-password-hashes-using-safe-functions
Maybe something like https://docs.rs/constant_time_eq/latest/constant_time_eq/ could be used instead, but I don't know much about rust ecosystem so I am can not really recommend any implementation.
Log
If applicable, add logs to help explain your problem.
Environment:
@sigoden commented on GitHub (Jun 2, 2023):
This is over optimized