You cannot select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
20 lines
753 B
C
20 lines
753 B
C
13 years ago
|
#include <byte.h>
|
||
|
|
|
||
|
|
/* If you need to compare a password or a hash value, the timing of the
|
||
|
|
* comparison function can give valuable clues to the attacker. Let's
|
||
|
|
* say the password is 123456 and the attacker tries abcdef. If the
|
||
|
|
* comparision function fails at the first byte without looking at the
|
||
|
|
* other bytes, then the attacker can measure the difference in runtime
|
||
|
|
* and deduce which byte was wrong, reducing the attack space from
|
||
|
|
* exponential to polynomial. */
|
||
|
|
int byte_equal_notimingattack(const void* a, size_t len,const void* b) {
|
||
|
|
size_t i;
|
||
|
|
const unsigned char* x=(const unsigned char*)a;
|
||
|
|
const unsigned char* y=(const unsigned char*)b;
|
||
|
|
unsigned char res=0;
|
||
|
|
for (i=0; i<len; ++i) {
|
||
|
|
res |= (x[i]^y[i]);
|
||
|
|
}
|
||
|
|
return res==0;
|
||
|
|
}
|