(couchdb) 02/13: optimize couch_passwords:verify for OTP 25+

[rn...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

rnewson pushed a commit to branch decouple_offline_hash_strength_from_online
in repository https://gitbox.apache.org/repos/asf/couchdb.git

commit d16e2e1f8992f1f0715fb779efc0bf3669925469
Author: Robert Newson <rn...@apache.org>
AuthorDate: Tue Oct 24 13:32:20 2023 +0100

    optimize couch_passwords:verify for OTP 25+
---
 src/couch/src/couch_passwords.erl | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/src/couch/src/couch_passwords.erl b/src/couch/src/couch_passwords.erl
index 45b335f99..eb1c27a72 100644
--- a/src/couch/src/couch_passwords.erl
+++ b/src/couch/src/couch_passwords.erl
@@ -117,6 +117,14 @@ pbkdf2(Password, Salt, Iterations, DerivedLength) when
     {ok, couch_util:to_hex_bin(DerivedKey)}.
 
 %% verify two lists for equality without short-circuits to avoid timing attacks.
+-if((?OTP_RELEASE) >= 25).
+verify(ListA, ListB) when is_list(ListA), is_list(ListB) ->
+    verify(?l2b(ListA), ?l2b(ListB));
+verify(BinA, BinB) when is_binary(BinA), is_binary(BinB), byte_size(BinA) == byte_size(BinB) ->
+    crypto:hash_equals(BinA, BinB);
+verify(BinA, BinB) when is_binary(BinA), is_binary(BinB) ->
+    false.
+-else.
 -spec verify(string(), string(), integer()) -> boolean().
 verify([X | RestX], [Y | RestY], Result) ->
     verify(RestX, RestY, (X bxor Y) bor Result);
@@ -137,3 +145,4 @@ verify(X, Y) when is_list(X) and is_list(Y) ->
     end;
 verify(_X, _Y) ->
     false.
+-endif.