Bug 17286 – A function for comparing two digests securely

Given two strings A and B, using std.algorithm.equal to compare them leaves your web application open to timing attacks because it has a short circuit, i.e. it returns false on the first inequality. The attack comes from allowing attacker to brute force you HMAC key. See this article for more information and why Java gets it wrong: https://codahale.com/a-lesson-in-timing-attacks/ The solution is to have a string comparison that will always be constant time given two strings of the same length.

Commits pushed to master at https://github.com/dlang/phobos https://github.com/dlang/phobos/commit/290447ead429608c818db8c263c4df9b722c37c2 Fix Issue 17286 - A function for comparing two digests securely https://github.com/dlang/phobos/commit/30b9da518941e2dfad18acbc1d99a2a2790d996a Merge pull request #5312 from JackStouffer/secureCompare Fix Issue 17286 - A function for comparing two digests securely

Commits pushed to stable at https://github.com/dlang/phobos https://github.com/dlang/phobos/commit/290447ead429608c818db8c263c4df9b722c37c2 Fix Issue 17286 - A function for comparing two digests securely https://github.com/dlang/phobos/commit/30b9da518941e2dfad18acbc1d99a2a2790d996a Merge pull request #5312 from JackStouffer/secureCompare

Commits pushed to newCTFE at https://github.com/dlang/phobos https://github.com/dlang/phobos/commit/290447ead429608c818db8c263c4df9b722c37c2 Fix Issue 17286 - A function for comparing two digests securely https://github.com/dlang/phobos/commit/30b9da518941e2dfad18acbc1d99a2a2790d996a Merge pull request #5312 from JackStouffer/secureCompare

Commits pushed to dmd-cxx at https://github.com/dlang/phobos https://github.com/dlang/phobos/commit/290447ead429608c818db8c263c4df9b722c37c2 Fix Issue 17286 - A function for comparing two digests securely https://github.com/dlang/phobos/commit/30b9da518941e2dfad18acbc1d99a2a2790d996a Merge pull request #5312 from JackStouffer/secureCompare