[jira] [Created] (WSS-677) Comparison in validate class is vulnerable to timing side channels

["Saeid Tizpaz-Niari (Jira)" <ji...@apache.org>]

Saeid Tizpaz-Niari created WSS-677:
--------------------------------------

             Summary: Comparison in validate class is vulnerable to timing side channels
                 Key: WSS-677
                 URL: https://issues.apache.org/jira/browse/WSS-677
             Project: WSS4J
          Issue Type: Bug
          Components: WSS4J Core
    Affects Versions: 2.3.0
         Environment: JDK 1.8
            Reporter: Saeid Tizpaz-Niari
            Assignee: Colm O hEigeartaigh


Hello,

We recently noticed potential timing side channels in the implementation of password comparisons. The issue is in org.apache.wss4j.dom.validate package in UsernameTokenValidator class inside verifyDigestPassword() method where it uses Java string *equal* to compare given password against the stored one. This is a well-known issue first reported in the following articles:

[https://rdist.root.org/2009/05/28/timing-attack-in-google-keyczar-library/]

[https://github.com/eclipse/jetty.project/issues/1556]

Also, I am sending recent fixes for this type of vulnerable (Eclipse Jetty and OpenJDK crypto)

[https://github.com/eclipse/jetty.project/blob/jetty-9.4.x/jetty-util/src/main/java/org/eclipse/jetty/util/security/Credential.java#L94]

[http://hg.openjdk.java.net/jdk8u/jdk8u-dev/jdk/rev/26deba50fea8]

Please let us know if you have any questions,

Best Regards,

Saeid (saeid.tizpazniari@colorado.edu)

Yannic (yannic.noller@acm.org)



--
This message was sent by Atlassian Jira
(v8.3.4#803005)

---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@ws.apache.org
For additional commands, e-mail: dev-help@ws.apache.org