From 6d33e721c41bdb0fe7da6404e6d6d32509eed6be Mon Sep 17 00:00:00 2001 From: Alex Auvolat Date: Thu, 29 Feb 2024 12:43:25 +0100 Subject: [PATCH] [fix-auth-ct-eq] use consant time comparison for awsv4 signature verification --- src/api/signature/payload.rs | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/src/api/signature/payload.rs b/src/api/signature/payload.rs index 949da601..a9e7d34d 100644 --- a/src/api/signature/payload.rs +++ b/src/api/signature/payload.rs @@ -375,9 +375,10 @@ pub async fn verify_v4( ) .ok_or_internal_error("Unable to build signing HMAC")?; hmac.update(payload); - let our_signature = hex::encode(hmac.finalize().into_bytes()); - if auth.signature != our_signature { - return Err(Error::forbidden("Invalid signature".to_string())); + let signature = + hex::decode(&auth.signature).map_err(|_| Error::forbidden("Invalid signature"))?; + if hmac.verify_slice(&signature).is_err() { + return Err(Error::forbidden("Invalid signature")); } Ok(key)