Skip to content

Commit 0fc5e0d

Browse files
not-an-aardvarkjasnell
authored andcommitted
crypto: add crypto.timingSafeEqual
PR-URL: #8040 Reviewed-By: Ben Noordhuis <[email protected]> Reviewed-By: James M Snell <[email protected]> Reviewed-By: Fedor Indutny <[email protected]>
1 parent de3d805 commit 0fc5e0d

File tree

5 files changed

+178
-0
lines changed

5 files changed

+178
-0
lines changed

doc/api/crypto.md

+9
Original file line numberDiff line numberDiff line change
@@ -1217,6 +1217,15 @@ keys:
12171217

12181218
All paddings are defined in `crypto.constants`.
12191219

1220+
### crypto.timingSafeEqual(a, b)
1221+
1222+
Returns true if `a` is equal to `b`, without leaking timing information that
1223+
would allow an attacker to guess one of the values. This is suitable for
1224+
comparing HMAC digests or secret values like authentication cookies or
1225+
[capability urls](https://www.w3.org/TR/capability-urls/).
1226+
1227+
`a` and `b` must both be `Buffer`s, and they must have the same length.
1228+
12201229
### crypto.privateEncrypt(private_key, buffer)
12211230

12221231
Encrypts `buffer` with `private_key`.

lib/crypto.js

+3
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,7 @@ const getHashes = binding.getHashes;
1616
const getCurves = binding.getCurves;
1717
const getFipsCrypto = binding.getFipsCrypto;
1818
const setFipsCrypto = binding.setFipsCrypto;
19+
const timingSafeEqual = binding.timingSafeEqual;
1920

2021
const Buffer = require('buffer').Buffer;
2122
const stream = require('stream');
@@ -649,6 +650,8 @@ Object.defineProperty(exports, 'fips', {
649650
set: setFipsCrypto
650651
});
651652

653+
exports.timingSafeEqual = timingSafeEqual;
654+
652655
// Legacy API
653656
Object.defineProperty(exports, 'createCredentials', {
654657
configurable: true,

src/node_crypto.cc

+17
Original file line numberDiff line numberDiff line change
@@ -5771,6 +5771,22 @@ void ExportChallenge(const FunctionCallbackInfo<Value>& args) {
57715771
args.GetReturnValue().Set(outString);
57725772
}
57735773

5774+
void TimingSafeEqual(const FunctionCallbackInfo<Value>& args) {
5775+
Environment* env = Environment::GetCurrent(args);
5776+
5777+
THROW_AND_RETURN_IF_NOT_BUFFER(args[0], "First argument");
5778+
THROW_AND_RETURN_IF_NOT_BUFFER(args[1], "Second argument");
5779+
5780+
size_t buf_length = Buffer::Length(args[0]);
5781+
if (buf_length != Buffer::Length(args[1])) {
5782+
return env->ThrowTypeError("Input buffers must have the same length");
5783+
}
5784+
5785+
const char* buf1 = Buffer::Data(args[0]);
5786+
const char* buf2 = Buffer::Data(args[1]);
5787+
5788+
return args.GetReturnValue().Set(CRYPTO_memcmp(buf1, buf2, buf_length) == 0);
5789+
}
57745790

57755791
void InitCryptoOnce() {
57765792
OPENSSL_config(NULL);
@@ -5903,6 +5919,7 @@ void InitCrypto(Local<Object> target,
59035919
env->SetMethod(target, "setFipsCrypto", SetFipsCrypto);
59045920
env->SetMethod(target, "PBKDF2", PBKDF2);
59055921
env->SetMethod(target, "randomBytes", RandomBytes);
5922+
env->SetMethod(target, "timingSafeEqual", TimingSafeEqual);
59065923
env->SetMethod(target, "getSSLCiphers", GetSSLCiphers);
59075924
env->SetMethod(target, "getCiphers", GetCiphers);
59085925
env->SetMethod(target, "getHashes", GetHashes);

test/sequential/sequential.status

+5
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,11 @@ prefix sequential
66

77
[true] # This section applies to all platforms
88

9+
# crypto.timingSafeEqual contains a statistical timing test to verify that the
10+
# function is timing-safe. As a result, the test sometimes fails due to random
11+
# timing fluctuations.
12+
test-crypto-timing-safe-equal : PASS,FLAKY
13+
914
[$system==win32]
1015

1116
[$system==linux]
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,144 @@
1+
// Flags: --allow_natives_syntax
2+
'use strict';
3+
const common = require('../common');
4+
const assert = require('assert');
5+
6+
if (!common.hasCrypto) {
7+
common.skip('missing crypto');
8+
return;
9+
}
10+
11+
const crypto = require('crypto');
12+
13+
assert.strictEqual(
14+
crypto.timingSafeEqual(Buffer.from('foo'), Buffer.from('foo')),
15+
true,
16+
'should consider equal strings to be equal'
17+
);
18+
19+
assert.strictEqual(
20+
crypto.timingSafeEqual(Buffer.from('foo'), Buffer.from('bar')),
21+
false,
22+
'should consider unequal strings to be unequal'
23+
);
24+
25+
assert.throws(function() {
26+
crypto.timingSafeEqual(Buffer.from([1, 2, 3]), Buffer.from([1, 2]));
27+
}, 'should throw when given buffers with different lengths');
28+
29+
assert.throws(function() {
30+
crypto.timingSafeEqual('not a buffer', Buffer.from([1, 2]));
31+
}, 'should throw if the first argument is not a buffer');
32+
33+
assert.throws(function() {
34+
crypto.timingSafeEqual(Buffer.from([1, 2]), 'not a buffer');
35+
}, 'should throw if the second argument is not a buffer');
36+
37+
function runBenchmark(compareFunc, bufferA, bufferB, expectedResult) {
38+
const startTime = process.hrtime();
39+
const result = compareFunc(bufferA, bufferB);
40+
const endTime = process.hrtime(startTime);
41+
42+
// Ensure that the result of the function call gets used, so that it doesn't
43+
// get discarded due to engine optimizations.
44+
assert.strictEqual(result, expectedResult);
45+
return endTime[0] * 1e9 + endTime[1];
46+
}
47+
48+
function getTValue(compareFunc) {
49+
const numTrials = 10000;
50+
const testBufferSize = 10000;
51+
// Perform benchmarks to verify that timingSafeEqual is actually timing-safe.
52+
const bufferA1 = Buffer.alloc(testBufferSize, 'A');
53+
const bufferA2 = Buffer.alloc(testBufferSize, 'A');
54+
const bufferB = Buffer.alloc(testBufferSize, 'B');
55+
const bufferC = Buffer.alloc(testBufferSize, 'C');
56+
57+
const rawEqualBenches = Array(numTrials);
58+
const rawUnequalBenches = Array(numTrials);
59+
60+
for (let i = 0; i < numTrials; i++) {
61+
// First benchmark: comparing two equal buffers
62+
rawEqualBenches[i] = runBenchmark(compareFunc, bufferA1, bufferA2, true);
63+
// Second benchmark: comparing two unequal buffers
64+
rawUnequalBenches[i] = runBenchmark(compareFunc, bufferB, bufferC, false);
65+
}
66+
67+
const equalBenches = filterOutliers(rawEqualBenches);
68+
const unequalBenches = filterOutliers(rawUnequalBenches);
69+
70+
// Use a two-sample t-test to determine whether the timing difference between
71+
// the benchmarks is statistically significant.
72+
// https://wikipedia.org/wiki/Student%27s_t-test#Independent_two-sample_t-test
73+
74+
const equalMean = mean(equalBenches);
75+
const unequalMean = mean(unequalBenches);
76+
77+
const equalLen = equalBenches.length;
78+
const unequalLen = unequalBenches.length;
79+
80+
const combinedStd = combinedStandardDeviation(equalBenches, unequalBenches);
81+
const standardErr = combinedStd * Math.sqrt(1 / equalLen + 1 / unequalLen);
82+
83+
return (equalMean - unequalMean) / standardErr;
84+
}
85+
86+
// Returns the mean of an array
87+
function mean(array) {
88+
return array.reduce((sum, val) => sum + val, 0) / array.length;
89+
}
90+
91+
// Returns the sample standard deviation of an array
92+
function standardDeviation(array) {
93+
const arrMean = mean(array);
94+
const total = array.reduce((sum, val) => sum + Math.pow(val - arrMean, 2), 0);
95+
return Math.sqrt(total / (array.length - 1));
96+
}
97+
98+
// Returns the common standard deviation of two arrays
99+
function combinedStandardDeviation(array1, array2) {
100+
const sum1 = Math.pow(standardDeviation(array1), 2) * (array1.length - 1);
101+
const sum2 = Math.pow(standardDeviation(array2), 2) * (array2.length - 1);
102+
return Math.sqrt((sum1 + sum2) / (array1.length + array2.length - 2));
103+
}
104+
105+
// Filter large outliers from an array. A 'large outlier' is a value that is at
106+
// least 50 times larger than the mean. This prevents the tests from failing
107+
// due to the standard deviation increase when a function unexpectedly takes
108+
// a very long time to execute.
109+
function filterOutliers(array) {
110+
const arrMean = mean(array);
111+
return array.filter((value) => value / arrMean < 50);
112+
}
113+
114+
// Force optimization before starting the benchmark
115+
runBenchmark(crypto.timingSafeEqual, Buffer.from('A'), Buffer.from('A'), true);
116+
eval('%OptimizeFunctionOnNextCall(runBenchmark)');
117+
runBenchmark(crypto.timingSafeEqual, Buffer.from('A'), Buffer.from('A'), true);
118+
119+
// t_(0.9995, ∞)
120+
// i.e. If a given comparison function is indeed timing-safe, the t-test result
121+
// has a 99.9% chance to be below this threshold. Unfortunately, this means that
122+
// this test will be a bit flakey and will fail 0.1% of the time even if
123+
// crypto.timingSafeEqual is working properly.
124+
// t-table ref: http://www.sjsu.edu/faculty/gerstman/StatPrimer/t-table.pdf
125+
// Note that in reality there are roughly `2 * numTrials - 2` degrees of
126+
// freedom, not ∞. However, assuming `numTrials` is large, this doesn't
127+
// significantly affect the threshold.
128+
const T_THRESHOLD = 3.291;
129+
130+
const t = getTValue(crypto.timingSafeEqual);
131+
assert(
132+
Math.abs(t) < T_THRESHOLD,
133+
`timingSafeEqual should not leak information from its execution time (t=${t})`
134+
);
135+
136+
// As a sanity check to make sure the statistical tests are working, run the
137+
// same benchmarks again, this time with an unsafe comparison function. In this
138+
// case the t-value should be above the threshold.
139+
const unsafeCompare = (bufA, bufB) => bufA.equals(bufB);
140+
const t2 = getTValue(unsafeCompare);
141+
assert(
142+
Math.abs(t2) > T_THRESHOLD,
143+
`Buffer#equals should leak information from its execution time (t=${t2})`
144+
);

0 commit comments

Comments
 (0)