diff options
Diffstat (limited to 'Doc/library/hmac.rst')
| -rw-r--r-- | Doc/library/hmac.rst | 45 |
1 files changed, 23 insertions, 22 deletions
diff --git a/Doc/library/hmac.rst b/Doc/library/hmac.rst index e9491fd..3fa0bd6 100644 --- a/Doc/library/hmac.rst +++ b/Doc/library/hmac.rst @@ -71,35 +71,36 @@ This module also provides the following helper function: .. function:: compare_digest(a, b) - Returns the equivalent of ``a == b``, but avoids content based - short circuiting behaviour to reduce the vulnerability to timing - analysis. The inputs must either both support the buffer protocol (e.g. - :class:`bytes` and :class:`bytearray` instances) or be ASCII only - :class:`str` instances as returned by :meth:`hexdigest`. - :class:`bytes` and :class:`str` instances can't be mixed. - - Using a short circuiting comparison (that is, one that terminates as soon - as it finds any difference between the values) to check digests for - correctness can be problematic, as it introduces a potential - vulnerability when an attacker can control both the message to be checked - *and* the purported signature value. By keeping the plaintext consistent - and supplying different signature values, an attacker may be able to use - timing variations to search the signature space for the expected value in - O(n) time rather than the desired O(2**n). + Return ``a == b``. This function uses an approach designed to prevent timing + analysis by avoiding content based short circuiting behaviour. The inputs + must either both support the buffer protocol (e.g. :class:`bytes` and + :class:`bytearray` instances) or be ASCII-only :class:`str` instances as + returned by :meth:`hexdigest`. :class:`bytes` and :class:`str` instances + can't be mixed. + + Using a short circuiting comparison (that is, one that terminates as soon as + it finds any difference between the values) to check digests for correctness + can be problematic, as it introduces a potential vulnerability when an + attacker can control both the message to be checked *and* the purported + signature value. By keeping the plaintext consistent and supplying different + signature values, an attacker may be able to use timing variations to search + the signature space for the expected value in O(n) time rather than the + desired O(2**n). .. note:: - While this function reduces the likelihood of leaking the contents of - the expected digest via a timing attack, it still may leak some timing + While this function reduces the likelihood of leaking the contents of the + expected digest via a timing attack, it still may leak some timing information when the input values differ in lengths as well as in error - cases like unsupported types or non ASCII strings. When the inputs have - different length the timing depends solely on the length of ``b``. It - is assumed that the expected length of the digest is not a secret, as - it is typically published as part of a file format, network protocol - or API definition. + cases like unsupported types or non ASCII strings. When the inputs have + different length the timing depends solely on the length of ``b``. It is + assumed that the expected length of the digest is not a secret, as it is + typically published as part of a file format, network protocol or API + definition. .. versionadded:: 3.3 + .. seealso:: Module :mod:`hashlib` |