Re: [http-auth] secdir review of draft-ietf-httpauth-basicauth-update-06

[Bjoern Hoehrmann <[e-mail]>]

* Julian Reschke wrote:
>On 2015-02-19 21:15, Daniel Kahn Gillmor wrote:
>> On Thu 2015-02-19 14:07:54 -0500, Julian Reschke wrote:
>>> The network exchange will be take milliseconds. The string comparison
>>> microseconds. /me not convinced there's a problem here.
>>
>> as long as the attacker can measure microseconds, and the network
>> exchange has small or regular-enough jitter to be accounted for with
>> statistical techniques, the size difference between these parts doesn't
>> matter to a timing attack.
>>
>>    http://www.cs.rice.edu/~dwallach/pub/crosby-timing2009.pdf
>>
>> says:
>>
>>     The resolution an attacker can time a remote host depends on how many
>>     measurements they can collect. Our simulated attacker using
>>     statistical hypothesis testing was able to reliably distinguish a
>>     processing time differences as low as 200ns and 30µs with 1,000
>>     measurements on the LAN and WAN respectively with. (See Section 6.)
>>
>> Note that salted, hashed passwords where the attacker doesn't know the
>> salt are resistant to using a timing oracle like this to do byte-by-byte
>> guessing.  I still think it's simpler to just recommend that the tests
>> should be constant time.
>
>I'm sorry, I'm not convinced. What do others think?

I would prefer to point to an existing document for considerations such
as this one, and I do not think it is entirely obvious for implementers
of the scheme that comparison should take time independent of the length
of the credentials, so including something brief about this makes sense
to me.
-- 
Björn Höhrmann · mailto:[e-mail] · http://bjoern.hoehrmann.de
D-10243 Berlin · PGP Pub. KeyID: 0xA4357E78 · http://www.bjoernsworld.de
 Available for hire in Berlin (early 2015)  · http://www.websitedev.de/