Mitigate timing oracle using dummy hash cache#1116
Mitigate timing oracle using dummy hash cache#1116stenslae wants to merge 1 commit into
Conversation
wolfSSL-Fenrir-bot
left a comment
There was a problem hiding this comment.
Fenrir Automated Review — PR #1116
Scan targets checked: wolfssh-bugs, wolfssh-src
Findings: 1
1 finding(s) posted as inline comments (see file-level comments below)
This review was generated automatically by Fenrir. Findings are non-blocking.
6be2e53 to
49470f2
Compare
wolfSSL-Fenrir-bot
left a comment
There was a problem hiding this comment.
Fenrir Automated Review — PR #1116
Scan targets checked: wolfssh-bugs, wolfssh-src
Findings: 1
1 finding(s) posted as inline comments (see file-level comments below)
This review was generated automatically by Fenrir. Findings are non-blocking.
49470f2 to
f1ec2b3
Compare
wolfSSL-Fenrir-bot
left a comment
There was a problem hiding this comment.
Fenrir Automated Review — PR #1116
Scan targets checked: wolfssh-bugs, wolfssh-src
Findings: 1
1 finding(s) posted as inline comments (see file-level comments below)
This review was generated automatically by Fenrir. Findings are non-blocking.
|
|
||
| /* Fake crypt() on early rejections to equalize timing. | ||
| * Minor syscall timing gap remains; closing it requires unsafe privilege escalation. */ | ||
| if (ret != WOLFSSH_USERAUTH_SUCCESS) { |
There was a problem hiding this comment.
🔵 [Low] DoFakePasswordCheck inverts timing oracle for public-key auth · Constant-time violations
DoFakePasswordCheck is called for ALL DoCheckUser rejections regardless of auth type, so unknown-user public-key attempts pay a full SHA-512 crypt() cost (~100 ms with rounds=5000) while known-user-wrong-key attempts pay none, creating a consistent timing oracle for pubkey-based user enumeration.
Fix: Guard the DoFakePasswordCheck call on DoCheckUser failure to only run when authData->type == WOLFSSH_USERAUTH_PASSWORD, avoiding the asymmetric overhead on non-password auth paths.
Does a fake crypt() operation when an authentication attempt is rejected early and caches hash type at SSHD startup. CI testing is added for this change.