• antirez's avatar
    Fixed a timing attack on AUTH (Issue #560). · 4b3865cb
    antirez authored
    The way we compared the authentication password using strcmp() allowed
    an attacker to gain information about the password using a well known
    class of attacks called "timing attacks".
    
    The bug appears to be practically not exploitable in most modern systems
    running Redis since even using multiple bytes of differences in the
    input at a time instead of one the difference in running time in in the
    order of 10 nanoseconds, making it hard to exploit even on LAN. However
    attacks always get better so we are providing a fix ASAP.
    
    The new implementation uses two fixed length buffers and a constant time
    comparison function, with the goal of:
    
    1) Completely avoid leaking information about the content of the
    password, since the comparison is always performed between 512
    characters and without conditionals.
    2) Partially avoid leaking information about the length of the
    password.
    
    About "2" we still have a stage in the code where the real password and
    the user provided password are copied in the static buffers, we also run
    two strlen() operations against the two inputs, so the running time
    of the comparison is a fixed amount plus a time proportional to
    LENGTH(A)+LENGTH(B). This means that the absolute time of the operation
    performed is still related to the length of the password in some way,
    but there is no way to change the input in order to get a difference in
    the execution time in the comparison that is not just proportional to
    the string provided by the user (because the password length is fixed).
    
    Thus in practical terms the user should try to discover LENGTH(PASSWORD)
    looking at the whole execution time of the AUTH command and trying to
    guess a proportionality between the whole execution time and the
    password length: this appears to be mostly unfeasible in the real world.
    
    Also protecting from this attack is not very useful in the case of Redis
    as a brute force attack is anyway feasible if the password is too short,
    while with a long password makes it not an issue that the attacker knows
    the length.
    4b3865cb
config.c 37 KB