Comments (11)
Unless there's a cleverer attack that I'm unaware of, the timing side channel attack allows recovering the secret HMAC value byte-by-byte. This attack is thwarted if Bytes.equal(s1, s2) compares SHA256(s1) with SHA256(s2). Yes, the adversary knows what bytes being compared, but that's not enough because they need to find a pre-image that hashes to those bytes.
More concretely, they know SHA256(s1) and they can use the timing side channel to figure out the first byte of SHA256(s2). Now what? They need to find s1' such that its first byte matches the first byte of SHA256(s1) and its second byte matches the second byte of SHA256(s2). Before long, the adversary has to reverse SHA256.
from tink.
Bytes.equal is mostly used to validate MAC, thus we're already doing what you're suggesting, right?
from tink.
No. The problem is that one of the MACs is attacker controlled. So, if one value is unknown (the correct MAC calculated under a secret key) and the other is attacker controlled, then if Bytes.equal()
has a timing signal, an attacker can use this to guess the secret MAC. (This is why you are using this standard constant-time algorithm.)
Unfortunately, the JVM and JIT does terrible things to constant time algorithms and can break them horribly. By calculating a MAC under a random key of the values and then comparing those MACs, even if the algorithm isn't constant time, the attacker has no way of knowing what bytes are being compared to what bytes and cannot execute the attack.
NCC Group wrote about an extremely similar defense they call Double HMAC Verification. I prefer my proposed modification because it doesn't require knowledge of the HMAC key (and may be applied to things other than HMACs) and because it is even more randomized than reusing a key multiple times dor the comparison.
from tink.
Ah I now see what you meant.
Did NCC Group even publish their paper? I want to understand why Bytes.equal doesn't work as they claimed.
Also not sure we need to use double HMAC. Why isn't applying a round of SHA256 enough?
from tink.
I have no idea about JVM and constant time algorithms but I don't think a round of SHA256 would be enough, because the attacker could also compute it and would thus know what bytes are being compared. Computing a MAC under a (secret) random key does not reveal that to the attacker.
from tink.
from tink.
Looks like overkill to me.
I've been trying to find compilers that would convert functions like Bytes.equal() into
something that is non-constant time. So far without success. Are there examples?
Typically, compilers rather try to remove branches rather than to add new ones to
avoid the cost of branch mispredictions.
from tink.
How I feel about that blog being cited to @thaidn and @bleichen : https://www.theonion.com/bush-finds-error-in-fermilab-calculations-1819566086
(Is is overkill, was intended as advice for naive developers, and it does weaken the HMAC verification against brute force guessing to the collision probability of the hash function.)
from tink.
@hillbrad Thank you. I'm also going to try to track down (and then make public) the other data I found. However until I can find something more solid, we should probably consider this issue closed.
from tink.
Thanks folks. Closing this bug, but please feel free to reopen once you've gathered more data.
from tink.
It should be possible to use the PrintAssembly command line option for the JVM to have HotSpot emit the generated assembly, which can then be verified for constant-time operation on an architecture-by-architecture basis.
from tink.
Related Issues (20)
- tink cannot be installed on arm64 linux HOT 9
- Cannot install it with googleapis-common-protos and other related libs in python HOT 7
- Envelope AEAD Performance with GCP KMS HOT 1
- java tink library is not scaling with java threads HOT 1
- Tink installation on bazel and pip3 fail HOT 4
- Missing classes dectected while running R8 HOT 11
- Is Tink for Objective-C buildable via Bazel? HOT 9
- Recommendation on the best approach for rotation HOT 1
- tink 1.7.0 depends on protobuf 3.20.1 which has a security vulnerability patched in a newer version HOT 4
- Windows OS Support HOT 4
- Cannot download tinkey - The project to be billed is associated with a closed billing account. HOT 2
- cannot verify signature HOT 3
- java.security.GeneralSecurityException: cannot verify signature HOT 1
- No manager for type 'type.googleapis.com/google.crypto.tink.HpkePrivateKey' has been registered HOT 2
- H HOT 1
- compile tink cpp library for ios HOT 4
- OSS-Fuzz issue 66058 HOT 1
- Intent to archive https://github.com/google/tink
- Duplicate class found in modules jetified-tink-1.8.0 and jetified-tink-android-1.8.0 HOT 1
- Add PRF Documentation to website HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from tink.