Skip to content

Commit 0fc487f

Browse files
artem-smotrakovartem-smotrakov
committed
Better qhelp for timing attacks
1 parent 9b953cf commit 0fc487f

7 files changed

+50
-66
lines changed

‎java/ql/src/experimental/Security/CWE/CWE-208/NonConstantTimeCheckOnSignature.qhelp

Lines changed: 3 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -10,13 +10,7 @@ A successful attack may uncover a valid signature that in turn can result in aut
1010
</p>
1111
</overview>
1212

13-
<recommendation>
14-
<p>
15-
Use <code>MessageDigest.isEqual()</code> method to check MACs and signatures.
16-
If this method is used, then the calculation time depends only on the length of input byte arrays,
17-
and does not depend on the contents of the arrays.
18-
</p>
19-
</recommendation>
13+
<include src="NonConstantTimeCheckRecommendation.inc.qhelp" />
2014

2115
<example>
2216
<p>
@@ -29,25 +23,8 @@ This method implements a non-constant-time algorithm:
2923
The next example uses a safe constant-time algorithm for validating a MAC:
3024
</p>
3125
<sample src="SafeMacComparison.java" />
32-
3326
</example>
3427

35-
<references>
36-
<li>
37-
Wikipedia:
38-
<a href="https://en.wikipedia.org/wiki/Timing_attack">Timing attack</a>.
39-
</li>
40-
<li>
41-
Coursera:
42-
<a href="https://www.coursera.org/lecture/crypto/timing-attacks-on-mac-verification-FHGW1">Timing attacks on MAC verification</a>
43-
</li>
44-
<li>
45-
NCC Group:
46-
<a href="https://www.nccgroup.trust/globalassets/our-research/us/whitepapers/TimeTrial.pdf">Time Trial: Racing Towards Practical Remote Timing Attacks</a>
47-
</li>
48-
<li>
49-
Java API Specification:
50-
<a href="https://docs.oracle.com/en/java/javase/11/docs/api/java.base/java/security/MessageDigest.html#isEqual(byte[],byte[])">MessageDigest.isEqual() method</a>
51-
</li>
52-
</references>
28+
<include src="NonConstantTimeCheckReferences.inc.qhelp" />
29+
5330
</qhelp>

‎java/ql/src/experimental/Security/CWE/CWE-208/NonConstantTimeCheckOnSignature.ql

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,9 @@
11
/**
22
* @name Using a non-constant-time algorithm for checking a signature
3-
* @description When checking a signature, a constant-time algorithm should be used.
4-
* Otherwise, an attacker may be able to implement a timing attack.
5-
* A successful attack may uncover a valid signature
6-
* that in turn can result in authentication bypass.
3+
* @description When checking a signature over a message, a constant-time algorithm should be used.
4+
* Otherwise, there is a risk of a timing attack that allows an attacker
5+
* to forge a valid signature for an arbitrary message. For a successful attack,
6+
* the attacker has to be able to send to the validation procedure both the message and the signature.
77
* @kind path-problem
88
* @problem.severity warning
99
* @precision medium

‎java/ql/src/experimental/Security/CWE/CWE-208/NonConstantTimeCheckOnSignatureQuery.qll

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -292,7 +292,7 @@ class NonConstantTimeComparisonSink extends DataFlow::Node {
292292

293293
NonConstantTimeComparisonSink() {
294294
(
295-
isNonConstantEqualsCall(this.asExpr(), anotherParameter)
295+
isNonConstantTimeEqualsCall(this.asExpr(), anotherParameter)
296296
or
297297
isNonConstantTimeComparisonCall(this.asExpr(), anotherParameter)
298298
or

‎java/ql/src/experimental/Security/CWE/CWE-208/NonConstantTimeCheckRecommendation.inc.qhelp

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
<!DOCTYPE qhelp PUBLIC "-//Semmle//qhelp//EN" "qhelp.dtd">
2+
<qhelp>
3+
<recommendation>
4+
<p>
5+
Use <code>MessageDigest.isEqual()</code> method to check MACs and signatures.
6+
If this method is used, then the calculation time depends only on the length of input byte arrays,
7+
and does not depend on the contents of the arrays.
8+
</p>
9+
</recommendation>
10+
</qhelp>

‎java/ql/src/experimental/Security/CWE/CWE-208/NonConstantTimeCheckReferences.inc.qhelp

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
<!DOCTYPE qhelp PUBLIC "-//Semmle//qhelp//EN" "qhelp.dtd">
2+
<qhelp>
3+
<references>
4+
<li>
5+
Wikipedia:
6+
<a href="https://en.wikipedia.org/wiki/Timing_attack">Timing attack</a>.
7+
</li>
8+
<li>
9+
Coursera:
10+
<a href="https://www.coursera.org/lecture/crypto/timing-attacks-on-mac-verification-FHGW1">Timing attacks on MAC verification</a>
11+
</li>
12+
<li>
13+
NCC Group:
14+
<a href="https://www.nccgroup.trust/globalassets/our-research/us/whitepapers/TimeTrial.pdf">Time Trial: Racing Towards Practical Remote Timing Attacks</a>
15+
</li>
16+
<li>
17+
Java API Specification:
18+
<a href="https://docs.oracle.com/en/java/javase/11/docs/api/java.base/java/security/MessageDigest.html#isEqual(byte[],byte[])">MessageDigest.isEqual() method</a>
19+
</li>
20+
</references>
21+
</qhelp>

‎java/ql/src/experimental/Security/CWE/CWE-208/TimingAttackAgainstSignature.qhelp

Lines changed: 6 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -5,23 +5,17 @@
55
<p>
66
A constant-time algorithm should be used for checking a MAC or a digital signature.
77
In other words, the comparison time should not depend on the content of the input.
8-
Otherwise, an attacker may be able to implement a timing attack if they control inputs
9-
for the cryptographic operation and the checking prodedure.
10-
A successful attack may uncover a valid signature that in turn can result in authentication bypass.
8+
Otherwise, an attacker may be able to forge a valid signature for an arbitrary message
9+
by running a timing attack if they can send to the validation procedure
10+
both the message and the signature. A successful attack can result in authentication bypass.
1111
</p>
1212
</overview>
1313

14-
<recommendation>
15-
<p>
16-
Use <code>MessageDigest.isEqual()</code> method to check MACs and signatures.
17-
If this method is used, then the calculation time depends only on the length of input byte arrays,
18-
and does not depend on the contents of the arrays.
19-
</p>
20-
</recommendation>
14+
<include src="NonConstantTimeCheckRecommendation.inc.qhelp" />
2115

2216
<example>
2317
<p>
24-
The following example uses <code>Arrays.equals()</code> method for validating a MAC over a messgae.
18+
The following example uses <code>Arrays.equals()</code> method for validating a MAC over a message.
2519
This method implements a non-constant-time algorithm.
2620
Both the message and the signature come from an untrusted HTTP request:
2721
</p>
@@ -31,25 +25,7 @@ Both the message and the signature come from an untrusted HTTP request:
3125
The next example uses a safe constant-time algorithm for validating a MAC:
3226
</p>
3327
<sample src="SafeMacComparisonWithRemoteInputs.java" />
34-
3528
</example>
3629

37-
<references>
38-
<li>
39-
Wikipedia:
40-
<a href="https://en.wikipedia.org/wiki/Timing_attack">Timing attack</a>.
41-
</li>
42-
<li>
43-
Coursera:
44-
<a href="https://www.coursera.org/lecture/crypto/timing-attacks-on-mac-verification-FHGW1">Timing attacks on MAC verification</a>
45-
</li>
46-
<li>
47-
NCC Group:
48-
<a href="https://www.nccgroup.trust/globalassets/our-research/us/whitepapers/TimeTrial.pdf">Time Trial: Racing Towards Practical Remote Timing Attacks</a>
49-
</li>
50-
<li>
51-
Java API Specification:
52-
<a href="https://docs.oracle.com/en/java/javase/11/docs/api/java.base/java/security/MessageDigest.html#isEqual(byte[],byte[])">MessageDigest.isEqual() method</a>
53-
</li>
54-
</references>
30+
<include src="NonConstantTimeCheckReferences.inc.qhelp" />
5531
</qhelp>

‎java/ql/src/experimental/Security/CWE/CWE-208/TimingAttackAgainstSignature.ql

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,10 @@
11
/**
22
* @name Timing attack against signature validation
3-
* @description When checking a signature, a constant-time algorithm should be used.
4-
* Otherwise, an attacker may be able to implement a timing attack
5-
* if they control inputs for the cryptographic operation and the checking procedure.
6-
* A successful attack may uncover a valid signature
7-
* that in turn can result in authentication bypass.
3+
* @description When checking a signature over a message, a constant-time algorithm should be used.
4+
* Otherwise, an attacker may be able to forge a valid signature for an arbitrary message
5+
* by running a timing attack if they can send to the validation procedure
6+
* both the message and the signature.
7+
* A successful attack can result in authentication bypass.
88
* @kind path-problem
99
* @problem.severity error
1010
* @precision high

0 commit comments

Comments
 (0)