Mdthbs

Is it safe to keep the GPU on 100% utilization for a very long time?

"Estrontium" on poster

Why did they wait for Quill to arrive?

Why do unstable nuclei form?

Gift for mentor after his thesis defense?

Integral with DiracDelta. Can Mathematica be made to solve this?

How can I make parentheses stick to formula?

Has everyone forgotten about wildfire?

Not taking the bishop with the knight, why?

Is there any evidence to support the claim that the United States was "suckered into WW1" by Zionists, made by Benjamin Freedman in his 1961 speech

Examples where existence is harder than evaluation

My perfect evil overlord plan... or is it?

How does weapons training transfer to empty hand?

Are double contractions formal? Eg: "couldn't've" for "could not have"

Two (probably) equal real numbers which are not proved to be equal?

Is every story set in the future "science fiction"?

Publishing an article in a journal without a related degree

What can cause an unfrozen indoor copper drain pipe to crack?

Is it a good idea to copy a trader when investing?

Are on’yomi words loanwords?

Does a surprised creature obey the 1st level spell Command?

A Latin text with dependency tree

What replaces x86 intrinsics for C when Apple ditches Intel CPUs for their own chips?

Has there been evidence of any other gods?

Why should password hash verification be time consistent?

Why is it always `HASH( salt + password )` that we recommend?What encryption hash function I should use for password securing?Why we use GPG signatures for file verification instead of hash values?Why should I hash passwords?Should email verification be followed by password-based login? Why?Potential collision with hash passwordWhy is hashing a password with multiple hash functions useless?Why should password authentication require sending the password?Send hash password or send password to hash in server?Why should we protect access to password hashes?

.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty{ margin-bottom:0;
}

3

1

In the asp.net core PasswordHasher type there is is remark on the VerifyHashedPassword method

 /// <remarks>Implementations of this method should be time consistent.</remarks>

And then to compare the hashes it uses code that is deliberately not optimised and written not do early exits in the loop.

// Compares two byte arrays for equality. The method is specifically written so that the loop is not optimized.

[MethodImpl(MethodImplOptions.NoInlining | MethodImplOptions.NoOptimization)]

private static bool ByteArraysEqual(byte[] a, byte[] b)

{

    if (a == null && b == null)

    {

        return true;

    }

    if (a == null || b == null || a.Length != b.Length)

    {

        return false;

    }

    var areSame = true;

    for (var i = 0; i < a.Length; i++)

    {

       areSame &= (a[i] == b[i]);

    }

    return areSame;

}

At first I thought that without this timing could be used to determine how close the hash was, if it takes longer then more of the hash is the same.

However this doesn't make sense because the hash has gone through 1000 iterations of SHA256 at this point. So any change in the password would produce a completely different hash, and knowing that your password produces almost the correct hash does not help you find the correct one.

What is the purpose of ensuring a constant time hash verification?

passwords hash

share|improve this question

asked 3 hours ago

trampstertrampster

1163

New contributor

trampster is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.

• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  Is that function used for anything other than comparing hashes?
  
  – forest
  3 hours ago
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  no it is only used for comparing hashes
  
  – trampster
  3 hours ago
  

  
  
  
  

add a comment | 

3

1

In the asp.net core PasswordHasher type there is is remark on the VerifyHashedPassword method

 /// <remarks>Implementations of this method should be time consistent.</remarks>

And then to compare the hashes it uses code that is deliberately not optimised and written not do early exits in the loop.

// Compares two byte arrays for equality. The method is specifically written so that the loop is not optimized.

[MethodImpl(MethodImplOptions.NoInlining | MethodImplOptions.NoOptimization)]

private static bool ByteArraysEqual(byte[] a, byte[] b)

{

    if (a == null && b == null)

    {

        return true;

    }

    if (a == null || b == null || a.Length != b.Length)

    {

        return false;

    }

    var areSame = true;

    for (var i = 0; i < a.Length; i++)

    {

       areSame &= (a[i] == b[i]);

    }

    return areSame;

}

At first I thought that without this timing could be used to determine how close the hash was, if it takes longer then more of the hash is the same.

However this doesn't make sense because the hash has gone through 1000 iterations of SHA256 at this point. So any change in the password would produce a completely different hash, and knowing that your password produces almost the correct hash does not help you find the correct one.

What is the purpose of ensuring a constant time hash verification?

passwords hash

share|improve this question

asked 3 hours ago

trampstertrampster

1163

New contributor

trampster is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.

• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  Is that function used for anything other than comparing hashes?
  
  – forest
  3 hours ago
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  no it is only used for comparing hashes
  
  – trampster
  3 hours ago
  

  
  
  
  

add a comment | 

In the asp.net core PasswordHasher type there is is remark on the VerifyHashedPassword method

 /// <remarks>Implementations of this method should be time consistent.</remarks>

And then to compare the hashes it uses code that is deliberately not optimised and written not do early exits in the loop.

// Compares two byte arrays for equality. The method is specifically written so that the loop is not optimized.

[MethodImpl(MethodImplOptions.NoInlining | MethodImplOptions.NoOptimization)]

private static bool ByteArraysEqual(byte[] a, byte[] b)

{

    if (a == null && b == null)

    {

        return true;

    }

    if (a == null || b == null || a.Length != b.Length)

    {

        return false;

    }

    var areSame = true;

    for (var i = 0; i < a.Length; i++)

    {

       areSame &= (a[i] == b[i]);

    }

    return areSame;

}

At first I thought that without this timing could be used to determine how close the hash was, if it takes longer then more of the hash is the same.

However this doesn't make sense because the hash has gone through 1000 iterations of SHA256 at this point. So any change in the password would produce a completely different hash, and knowing that your password produces almost the correct hash does not help you find the correct one.

What is the purpose of ensuring a constant time hash verification?

passwords hash

share|improve this question

asked 3 hours ago

trampstertrampster

1163

New contributor

trampster is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.

 /// <remarks>Implementations of this method should be time consistent.</remarks>

// Compares two byte arrays for equality. The method is specifically written so that the loop is not optimized.

[MethodImpl(MethodImplOptions.NoInlining | MethodImplOptions.NoOptimization)]

private static bool ByteArraysEqual(byte[] a, byte[] b)

{

    if (a == null && b == null)

    {

        return true;

    }

    if (a == null || b == null || a.Length != b.Length)

    {

        return false;

    }

    var areSame = true;

    for (var i = 0; i < a.Length; i++)

    {

       areSame &= (a[i] == b[i]);

    }

    return areSame;

}

share|improve this question

asked 3 hours ago

trampstertrampster

1163

New contributor

trampster is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.

share|improve this question

asked 3 hours ago

trampstertrampster

1163

New contributor

trampster is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.

asked 3 hours ago

trampstertrampster

1163

New contributor

trampster is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.

asked 3 hours ago

trampstertrampster

1163

1 Answer
1

active

oldest

votes

5

Assuming neither of the hashes are secret and the hashes are secure (which SHA-256 is), there is no reason to check the hash in constant time. In fact, comparing hashes is one of the well-known alternatives to verifying passwords within a constant time routine. I can't say what reason the developers would give for doing this, but it is not technically necessary to make it constant time. Most likely, they were just being cautious. Non-constant time code in a cryptographic library makes auditors anxious.

More information about the theoretical weaknesses is discussed in an answer on the Cryptography site. It explains how, with a significant amount of queries, it can be possible to discover the first several bytes of the hash, which makes it possible to perform an offline computation to discard candidate passwords that obviously wouldn't match (their hash doesn't match the first few discovered bytes of the real hash) and avoid sending them to the password checking service, and why this is unlikely to be a real issue.

share|improve this answer

edited 3 hours ago

answered 3 hours ago

forestforest

41.2k18132148

add a comment | 

Your Answer

StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "162"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);

StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});

function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: false,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: null,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
noCode: true, onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});


}
});

trampster is a new contributor. Be nice, and check out our Code of Conduct.

draft saved

draft discarded

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Sign up using Google

Sign up using Facebook

Sign up using Email and Password

Post as a guest

Name

Email

Required, but never shown

StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsecurity.stackexchange.com%2fquestions%2f209807%2fwhy-should-password-hash-verification-be-time-consistent%23new-answer', 'question_page');
}
);

Post as a guest

Name

Email

Required, but never shown

5

Assuming neither of the hashes are secret and the hashes are secure (which SHA-256 is), there is no reason to check the hash in constant time. In fact, comparing hashes is one of the well-known alternatives to verifying passwords within a constant time routine. I can't say what reason the developers would give for doing this, but it is not technically necessary to make it constant time. Most likely, they were just being cautious. Non-constant time code in a cryptographic library makes auditors anxious.

More information about the theoretical weaknesses is discussed in an answer on the Cryptography site. It explains how, with a significant amount of queries, it can be possible to discover the first several bytes of the hash, which makes it possible to perform an offline computation to discard candidate passwords that obviously wouldn't match (their hash doesn't match the first few discovered bytes of the real hash) and avoid sending them to the password checking service, and why this is unlikely to be a real issue.

share|improve this answer

edited 3 hours ago

answered 3 hours ago

forestforest

41.2k18132148

add a comment | 

5

Assuming neither of the hashes are secret and the hashes are secure (which SHA-256 is), there is no reason to check the hash in constant time. In fact, comparing hashes is one of the well-known alternatives to verifying passwords within a constant time routine. I can't say what reason the developers would give for doing this, but it is not technically necessary to make it constant time. Most likely, they were just being cautious. Non-constant time code in a cryptographic library makes auditors anxious.

More information about the theoretical weaknesses is discussed in an answer on the Cryptography site. It explains how, with a significant amount of queries, it can be possible to discover the first several bytes of the hash, which makes it possible to perform an offline computation to discard candidate passwords that obviously wouldn't match (their hash doesn't match the first few discovered bytes of the real hash) and avoid sending them to the password checking service, and why this is unlikely to be a real issue.

share|improve this answer

edited 3 hours ago

answered 3 hours ago

forestforest

41.2k18132148

add a comment | 

Assuming neither of the hashes are secret and the hashes are secure (which SHA-256 is), there is no reason to check the hash in constant time. In fact, comparing hashes is one of the well-known alternatives to verifying passwords within a constant time routine. I can't say what reason the developers would give for doing this, but it is not technically necessary to make it constant time. Most likely, they were just being cautious. Non-constant time code in a cryptographic library makes auditors anxious.

More information about the theoretical weaknesses is discussed in an answer on the Cryptography site. It explains how, with a significant amount of queries, it can be possible to discover the first several bytes of the hash, which makes it possible to perform an offline computation to discard candidate passwords that obviously wouldn't match (their hash doesn't match the first few discovered bytes of the real hash) and avoid sending them to the password checking service, and why this is unlikely to be a real issue.

share|improve this answer

edited 3 hours ago

answered 3 hours ago

forestforest

41.2k18132148

share|improve this answer

edited 3 hours ago

answered 3 hours ago

forestforest

41.2k18132148

answered 3 hours ago

forestforest

41.2k18132148

answered 3 hours ago

forestforest

41.2k18132148