WolfSSL
/
wolfssh
mirror of https://github.com/wolfSSL/wolfssh.git
1
0
Fork 0
Code Issues Releases Wiki Activity

Merge pull request #915 from padelsbach/const-time-auth 

Replace WMEMCMP in CheckAuthKeysLine
pull/922/head
John Safranek 2026-04-15 09:20:46 -07:00 committed by GitHub
parent 9c8b4e8a2c 854a36248e
commit 543a6c2a2f
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 4 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
apps/wolfsshd/auth.c
View File

@ -229,7 +229,10 @@ static int CheckAuthKeysLine(char* line, word32 lineSz, const byte* key,
} }
} }
if (ret == WSSHD_AUTH_SUCCESS) { if (ret == WSSHD_AUTH_SUCCESS) {
if (keyCandSz != keySz || WMEMCMP(key, keyCand, keySz) != 0) { /* Constant-time compare to avoid leaking which prefix bytes of an
* authorized key match a candidate offered by a remote peer. */
if (keyCandSz != keySz ||
ConstantCompare(key, keyCand, keySz) != 0) {
ret = WSSHD_AUTH_FAILURE; ret = WSSHD_AUTH_FAILURE;
} }
} }