Pylons/pyramid — pull request #319 by rfk (2011-10-14 13:15:07+00:00)
Title: avoid timing attacks in signature comparison

The AuthTktAuthenticationPolicy appears to be vulnerable to a timing attack in its signature-checking code, of the kind described here:

http://rdist.root.org/2010/07/19/exploiting-remote-timing-attacks/

Basically, using digest == expected to check the signature makes it possible for an attacker to guess the correct signature one byte at a time, since the comparison will take longer to run when some of the guessed bytes are correct.

This patch uses a time-invariant comparison function to avoid leaking information via timing attacks.