Christopher Curtis via RT wrote:
Show quoted text>that means that this module may be susceptible to timing
>attacks.
Indeed it is, though the impact of the timing attack there is very
limited. At most it allows an attacker to determine the target hash,
which he still has to reverse to produce an acceptable passphrase.
But the hash isn't easy to extract, being obscured by the salting.
I'd be a lot more concerned by the underlying cryptographic algorithms,
implemented in a bunch of modules from diverse authors, most of which can
be expected to be susceptible to timing and other side-channel attacks.
S-box lookup, a very popular primitive, turns out to be susceptible to
timing attacks based on cache behaviour, for a start. Perl as a whole,
of course, has not been built as a platform for side-channel-resistant
crypto. In any serious use of Perl for crypto, therefore, timing should
be somewhat obscured, and you should not expect to defeat attackers who
can monitor your power consumption very finely.
Attacking the crypto algorithms under Authen-Passphrase could reveal the
salt being used, which would be a big help in extracting the target hash
by means of your original suggestion. But, as I noted, the attacker then
still has to actually reverse the hash. These side-channel attacks are
a much bigger worry in encryption situations, where a successful attack
can directly reveal data being encrypted, or a key being relied upon
for secrecy. If I were you I'd see that as a higher priority.
I don't think I can seriously harden Authen-Passphrase against
side-channel attacks. It's just not intended for use in situations
where side-channel attacks are feasible. I can, however, put a note in
the documentation to this effect.
-zefram
