Deuxfleurs
/
garage
41
37
Fork 55
Code Issues 70 Pull Requests 6 Releases 29 Wiki Activity

Fix potential timing side-channels in authentication mechanisms #737

Merged
lx merged 2 commits from fix-auth-ct-eq into main 2024-02-29 14:04:38 +00:00
Conversation 0 Commits 2 Files Changed 6 +109 -21
lx commented 2024-02-29 11:48:04 +00:00
Owner
Copy Link
  • Use Argon2 password hashing from the argon2 crate, and its associated verification function, to check admin and metric tokens
  • Use Hmac's built-in verification function that operates in constant-time for AWS signatures v4 verification
- [x] Use Argon2 password hashing from the `argon2` crate, and its associated verification function, to check admin and metric tokens - [x] Use `Hmac`'s built-in verification function that operates in constant-time for AWS signatures v4 verification
lx force-pushed fix-auth-ct-eq from b94532ee02 to 6d33e721c4 2024-02-29 12:07:26 +00:00 Compare
lx merged commit b8c7a560ef into main 2024-02-29 14:04:38 +00:00
lx deleted branch fix-auth-ct-eq 2024-02-29 14:04:39 +00:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
AdminAPI

Issues concerning the administration API

  
Bug

   
Check AWS

The behaviour should be checked against AWS S3

  
CI

Issues with Nix, Drone, Rust Compiler, etc.

  
Correctness

Issues of theoretical correctness that may impact edge-case scenarios

  
Critical

   
Documentation

   
Ideas

For abstract ideas/proposal to make Garage better, to better communicate our not yet achieved aims

  
Improvement

   
Low priority

For issues that we don't want to spend time on until made absolutely necessary

  
Newcomer

A bug that should be newcomer friendly.

  
Performance

   
S3 Compatibility

   
Testing

   
Usability

Propositions to make Garage easier to operate, by improving error reporting, CLI, etc.

No Label
AdminAPI
Bug
Check AWS
CI
Correctness
Critical
Documentation
Ideas
Improvement
Low priority
Newcomer
Performance
S3 Compatibility
Testing
Usability
Milestone
Clear milestone
No items
No Milestone
Assignees
Clear assignees
No Assignees
1 Participants
Notifications
Due Date
The due date is invalid or out of range. Please use the format 'yyyy-mm-dd'.

No due date set.

Dependencies

No dependencies set.

Reference: Deuxfleurs/garage#737
No description provided.
Delete Branch "fix-auth-ct-eq"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?