mgomes/api_auth — pull request #56 by leishman (2014-10-27 04:29:05+00:00)
Title: add secure equals method to prevent timing attacks

@mgomes

I updated the `signatures_match?` method to prevent timing attacks. The equality operator should not be used to compare two strings for authentication in Ruby (I believe). For example:

`'abc' == 'abc'` will take longer to evaluate than `'def' == 'abc'` because the ruby interpreter will return false after analyzing the first bytes of each string in the second example, but will iterate through each byte of the strings in the first example. This information can be used by a malicious actor in what is known as a timing attack.

There are two solutions I know of to protect against this timing attack:
- Implement a "constant time" equality method (constant in that it takes the same amount of time for any strings of given lengths, not that it is O(n))
- Test the equality of the HMAC of the strings (which in this case are HMACs themselves).

I learned about this attack from a Stanford professor in [this lecture](http://youtu.be/BCmrBpKZl78) and he recommended the solution I propose here.

All tests pass.