Feature #73456

closed

Timing attack vulnerability in Hash comparisons throughout the core

Added by Helmut Hummel about 8 years ago. Updated almost 8 years ago.

Status:

Closed

Priority:

Should have

Assignee:

Category:

Target version:

Start date:

2016-02-15

Due date:

% Done:

Estimated time:

PHP Version:

Tags:

Complexity:

Sprint Focus:

Description

Original report¶

recently I've been studying quite a few resources on cryptography and
application security
and among others I found the following post:

https://paragonie.com/blog/2015/11/preventing-timing-attacks-on-string-comparison-with-double-hmac-strategy

Remembering that Extbase/Fluid has a service class for HMAC
calculation/verification I checked the current
state and found that it is indeed vulnerable to timing attacks:

https://github.com/TYPO3/TYPO3.CMS/blob/f7af0487932dfa119f2490512e9108915f359e37/typo3/sysext/extbase/Classes/Security/Cryptography/HashService.php#L68

To fix this vulnerability at least the PHP function
http://php.net/hash_equals should be used.
For PHP < 5.6 there is a shim which could be pulled in as Composer
dependency:
https://packagist.org/packages/indigophp/hash-compat

Related issues 2 (0 open — 2 closed)