7 ms·
Haven't done much golang and don't have it installed on this laptop, but are string comparisons constant time? If not, I think there is potential for a timing
by ryalfalpha 13y ago
Haven't done much golang and don't have it installed on this laptop, but are string comparisons constant time?
If not, I think there is potential for a timing attack here?
if usr == _admin_usr && pw == _admin_pw {
return RootMode, nil
}
- omra 13y agoGo does not have constant time string comparisons by default. The crypto/subtle package supplies constant time comparisons.
- wilsonfiifi 13y agoThanks for pointing that out. Will look into it