diff options
| author | Jouni Malinen <j@w1.fi> | 2014-06-29 17:19:19 (GMT) |
|---|---|---|
| committer | Jouni Malinen <j@w1.fi> | 2014-07-02 09:38:47 (GMT) |
| commit | 05c79d6acdf2800cfe9d7d8a3a1e8f8545a53a03 (patch) | |
| tree | 7414f6bb9d16e65b6a17fff38f787919bc165b18 /src/eap_server | |
| parent | 675ddad1c20fffdb2795c80db9aa8ae96683ff81 (diff) | |
| download | hostap-05c79d6acdf2800cfe9d7d8a3a1e8f8545a53a03.zip hostap-05c79d6acdf2800cfe9d7d8a3a1e8f8545a53a03.tar.gz hostap-05c79d6acdf2800cfe9d7d8a3a1e8f8545a53a03.tar.bz2 | |
EAP-SIM/AKA: Use os_memcmp_const() for hash/password comparisons
This makes the implementation less likely to provide useful timing
information to potential attackers from comparisons of information
received from a remote device and private material known only by the
authorized devices.
Signed-off-by: Jouni Malinen <j@w1.fi>
Diffstat (limited to 'src/eap_server')
| -rw-r--r-- | src/eap_server/eap_server_aka.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/src/eap_server/eap_server_aka.c b/src/eap_server/eap_server_aka.c index 565c971..1907f20 100644 --- a/src/eap_server/eap_server_aka.c +++ b/src/eap_server/eap_server_aka.c @@ -336,7 +336,7 @@ static int eap_aka_verify_checkcode(struct eap_aka_data *data, else sha1_vector(1, &addr, &len, hash); - if (os_memcmp(hash, checkcode, hash_len) != 0) { + if (os_memcmp_const(hash, checkcode, hash_len) != 0) { wpa_printf(MSG_DEBUG, "EAP-AKA: Mismatch in AT_CHECKCODE"); return -1; } @@ -963,7 +963,7 @@ static void eap_aka_process_challenge(struct eap_sm *sm, */ if (attr->res == NULL || attr->res_len < data->res_len || attr->res_len_bits != data->res_len * 8 || - os_memcmp(attr->res, data->res, data->res_len) != 0) { + os_memcmp_const(attr->res, data->res, data->res_len) != 0) { wpa_printf(MSG_WARNING, "EAP-AKA: Challenge message did not " "include valid AT_RES (attr len=%lu, res len=%lu " "bits, expected %lu bits)", |