[FTPSERVER-485] Timing Side Channel PasswordEncryptor

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 1.1.1
• Fix Version/s: 1.1.2
• Component/s: Core
• Labels: easyfix pull-request-available
• Environment: tested on macOS High Sierra 10.13.4, but it is not relevant
• Flags: Important
• Assignee: Jonathan Valliere
• Reporter: Yannic Noller
• Created: 17/Apr/18 08:11
• Updated: 22/May/18 13:57
• Resolved: 22/May/18 13:57

Description

Dear Apache FTPServer developers,

We have found a timing side-channel in class org.apache.ftpserver.usermanager.ClearTextPasswordEncryptor, method "public boolean matches(String passwordToCheck, String storedPassword)". This is due to the use of String.equals for comparison which returns as soon as a character does not match. This represents a timing side channel, which could be used by a potential attacker to obtain knowledge about the hidden secret password.
Do you agree with our findings?

A similar issue is present in method "matches" from classes org.apache.ftpserver.usermanager.Md5PasswordEncryptor and org.apache.ftpserver.usermanager.SaltedPasswordEncryptor.

We found these classes in the latest version of your git repo: https://git-wip-us.apache.org/repos/asf?p=mina-ftpserver.git;a=summary

The problem can be fixed easily by using the following safe version for String comparison in all three methods:

public boolean isEqual_safe(String a, String b) {
char a_value[] = a.toCharArray();
char b_value[] = b.toCharArray();
boolean unused;
boolean matches = true;
for (int i = 0; i < a_value.length; i++) {
if (i < b_value.length) {
if (a_value[i] != b_value[i])

{ matches = false; }

else

{ unused = true; }

} else

{ unused = false; unused = true; }

}
return matches;
}

Do you agree with our patch proposal?

Please feel free to contact us for further clarification! You can reach us by the following email address:
[e-mail]

Best regards,
Yannic Noller