Azure/go-pkcs12

using bytes.Compare in MAC validation leaks timing information

dgryski opened this issue · 3 comments

dgryski commented

The code should use http://golang.org/pkg/crypto/subtle/#ConstantTimeCompare to avoid a timing attack.

dgryski commented

The code is already using hmac. Use hmac.Equal instead.

paulmey commented

@dgryski Thanks for the catch. Is the PR the right fix?

dgryski commented

Looks good to me.