all verify() methods now use "constant time" comparison function (see CHANGELOG for details)

1 files changed, 27 insertions, 7 deletions

diff --git a/CHANGES b/CHANGES
index 608d2af..7fb8c2c 100644
--- a/CHANGES
+++ b/CHANGES
@@ -32,6 +32,26 @@ Release History
 
     Other
 
+        .. _consteq-issue:
+
+        * All digest comparisons within Passlib are now done using
+          a "constant time" comparison function :func:`~passlib.utils.consteq`,
+          instead of ``==``.
+
+          *In detail:*
+
+              This change is motivated by an `hmac timing attack <http://rdist.root.org/2009/05/28/timing-attack-in-google-keyczar-library/>`_
+              which exploits ``==``'s short-circuit comparison algorithm.
+              This attack is generally not applicable to password hashes,
+              as it requires the attacker to both know the salt,
+              and be able to generate digests beginning with a specific prefix.
+              However, while this task should be computationally difficult
+              against modern hashes (such as :class:`!sha512_crypt`), this
+              change should pre-emptively protect Passlib in case someone
+              constructs a such an attack in the future. Furthermore, some of
+              the legacy hashes supported by Passlib (such as
+              :class:`!mysql323`) are already weak enough to be vulnerable.
+
         * Restored builtin pure-python BCrypt implementation
           (:mod:`passlib.utils._slow_bcrypt`) that was removed in v1.3.
           This implementation is still *WAY* to slow to be suitable
@@ -54,7 +74,7 @@ Release History
     under some of the other BCrypt implementations, such as OpenBSD's
     ``/etc/master.passwd``.
 
-    *In detail:*    
+    *In detail:*
 
         BCrypt hashes contain 4 "padding" bits in the encoded salt, and Passlib
         (<= 1.5.2) generated salts in a manner which frequently set some of the
@@ -64,23 +84,23 @@ Release History
         BCrypt salt generation needed to be fixed to ensure compatibility,
         and a route provided to correct existing hashes already out in the wild
         [issue 25].
-        
+
     *Changes in this release:*
-    
+
     .. currentmodule:: passlib.context
-      
+
     * BCrypt hashes generated by Passlib now have all padding bits cleared.
-    
+
     * Passlib will continue to accept BCrypt hashes that have padding bits
       set, but when it encounters them, it will issue a :exc:`UserWarning`
       recommending that the hash should be fixed (see below).
-      
+
     * Applications which use :meth:`CryptContext.verify_and_update` will
       have any such hashes automatically re-encoded the next time the user
       logs in.
 
     *To fix existing hashes:*
-    
+
         If you have BCrypt hashes which might have their padding bits set,
         you can import :class:`!passlib.hash.bcrypt`, and
         call ``clean_hash = bcrypt.normhash(hash)``.