Uploaded image for project: 'Shiro'
  1. Shiro
  2. SHIRO-547

Use MessageDigest#isEqual() instead of Arrays#equals() for comparing digests

    XMLWordPrintableJSON

    Details

    • Flags:
      Patch

      Description

      While looking through shiro code I noticed that there are three places which compare byte[]s representing hashes using `Arrays#equals()`

      To avoid potential timing attacks these should be using `MessageDigest#isEqual()`, which at least starting with Java 6u17 uses a constant-time comparison.

      I'm not sure which Java version shiro targets, but it might make sense to either require Java 7, or to at least strongly suggest this in the documentation.

      Attached a patch against trunk, but please also consider fixing this in the 1.2 branch.

        Attachments

        1. shiro-547-messagedigest.diff
          2 kB
          Andreas Kohn

          Activity

            People

            • Assignee:
              Unassigned
              Reporter:
              ankon Andreas Kohn
            • Votes:
              1 Vote for this issue
              Watchers:
              2 Start watching this issue

              Dates

              • Created:
                Updated:
                Resolved: