Uploaded image for project: 'WildFly Elytron'
  1. WildFly Elytron
  2. ELY-2419

Update GeneralName to make use of MessageDigest#isEqual to avoid a potential timing attack

XMLWordPrintable

      There are 4 places in GeneralName where Arrays#equals is currently used.

      Arrays#equals is vulnerable to timing attacks because it uses a non time-constant comparison.

      MessageDigest#isEqual uses a time-constant comparison which means that all bytes in the arrays will be compared.

      Update GeneralName so that it uses the MessageDigest#isEqual method instead of Arrays#equals.

              laxmivaka Laxmi Vaka (Inactive)
              fjuma1@redhat.com Farah Juma
              Votes:
              0 Vote for this issue
              Watchers:
              1 Start watching this issue

                Created:
                Updated:
                Resolved: