samizdatco/ngx-http-auth-digest — Issue #6: Susceptible to timing attack?
Author: samizdatco
Created: 2011-11-04 23:47:59+00:00
State: open

i followed the model of the auth_basic module which steps through the password file's contents on every request and verifies the client's credentials against the file bytes as it goes. as a result, the current implementation could be vulnerable to timing attacks (since it returns as soon as it finds a match).

the simplest solution to this would seem to be adding a sleep(random()) delaying the response by a few (dozen? hundred?) milliseconds. i presume the non-blocking way to do this would be to use a timer?