Now checking the hashes in constant time

This commit is contained in:
StNicolay 2023-06-06 20:04:39 +03:00
parent 10601d49ad
commit c8c7ba154a
Signed by: StNicolay
GPG Key ID: 9693D04DCD962B0D
3 changed files with 4 additions and 1 deletions

1
Cargo.lock generated
View File

@ -473,6 +473,7 @@ dependencies = [
"scrypt",
"sea-orm",
"sha2",
"subtle",
"thiserror",
]

View File

@ -16,3 +16,4 @@ rand = { version = "0.8.5", default-features = false, features = ["std_rng"] }
sea-orm = "0.11.3"
bitflags = "2.3.1"
arrayvec = "0.7.2"
subtle = "2.5.0"

View File

@ -2,6 +2,7 @@ use entity::master_pass;
use rand::{rngs::OsRng, RngCore};
use scrypt::{scrypt, Params};
use sea_orm::ActiveValue::Set;
use subtle::ConstantTimeEq;
/// Hashes the password with Scrypt with the given salt
#[inline]
@ -21,7 +22,7 @@ impl VerifyMasterPassExt for master_pass::Model {
#[inline]
fn verify(&self, password: &str) -> bool {
let hashed = hash_password(password.as_bytes(), &self.salt);
hashed == self.password_hash.as_slice()
hashed.ct_eq(&self.password_hash).into()
}
}