Re:Steam hit by major security breach
by pja on Monday July 27, 2015 @05:49AM
(#9954249)
Good point. Is there are library of constant time functions for security sensitive applications to replace the standard ones in libc? (Seems like the kind of thing that the OpenBSD people might have written.)
strcmp() is at least better than a buggy equivalent that doesn’t actually work :)
Re:Steam hit by major security breach
by SCHiM on Monday July 27, 2015 @07:33AM
(#9954534)
The idea is to use constant time hashing functions, and then compare the hashes instead of comparing the strings themselves. AFAIK there is no implementation of the C stdlib that makes sure no timing attacks can be performed.
strcmp() is at least better than a buggy equivalent that doesn’t actually work :)