Query
Relevant PR: github/codeql#6006
CVE ID(s)
The query detects a few known CVEs:
Report
A constant time algorithm should be used when comparing results of cryptographic operations such as hashes, MACs, signatures and ciphertexts. In other words, the comparison time should not depends on the content of the inputs. Otherwise, an attacker may be able to implement a timing attacks that may reveal sensitive information.
I'd like to propose a new experimental query that looks for data flows from cryptographic operations to methods that compare arrays or strings using a not-constant time algorithm.
Update: I've written a blog post about the query and timing attacks.
Result(s)
Query
Relevant PR: github/codeql#6006
CVE ID(s)
The query detects a few known CVEs:
Report
A constant time algorithm should be used when comparing results of cryptographic operations such as hashes, MACs, signatures and ciphertexts. In other words, the comparison time should not depends on the content of the inputs. Otherwise, an attacker may be able to implement a timing attacks that may reveal sensitive information.
I'd like to propose a new experimental query that looks for data flows from cryptographic operations to methods that compare arrays or strings using a not-constant time algorithm.
Update: I've written a blog post about the query and timing attacks.
Result(s)