GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — bpo-40791: Use CRYPTO_memcmp() for compare_digest by tiran · Pull Request #20456 · python/cpython

Conversation

@tiran

@tiran tiran commented May 27, 2020 •
edited by bedevere-bot
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown
Member

:func:hashlib.compare_digest uses OpenSSL's CRYPTO_memcmp() function
when OpenSSL is available.

Note: The _operator module is a builtin module. I don't want to add
libcrypto dependency to libpython. Therefore I duplicated the wrapper
function and added a copy to _hashopenssl.c.

Signed-off-by: Christian Heimes [email protected]

https://bugs.python.org/issue40791

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
@tiran
bpo-40791: Use CRYPTO_memcmp() for compare_digest
8c12e7b 
:func:`hashlib.compare_digest` uses OpenSSL's ``CRYPTO_memcmp()`` function
when OpenSSL is available.

Note: The ``_operator`` module is a builtin module. I don't want to add
libcrypto dependency to libpython. Therefore I duplicated the wrapper
function and added a copy to ``_hashopenssl.c``.

Signed-off-by: Christian Heimes <[email protected]>
@tiran
tiran requested a review from gpshead May 27, 2020 16:12
@the-knights-who-say-ni the-knights-who-say-ni added the CLA signed label May 27, 2020
@bedevere-bot bedevere-bot added the awaiting core review label May 27, 2020
gpshead
gpshead reviewed May 27, 2020
View reviewed changes
Comment thread Modules/_hashopenssl.c Resolved

Uh oh!

There was an error while loading. Please reload this page.
gpshead
gpshead approved these changes May 27, 2020
View reviewed changes
@bedevere-bot bedevere-bot added awaiting merge and removed awaiting core review labels May 27, 2020
@gpshead gpshead added type-feature A feature request or enhancement type-security A security issue labels May 27, 2020
@tiran

tiran commented May 27, 2020

Copy link
Copy Markdown
Member Author

@gpshead 3.10-only or do you want to handle this as a security fix with backport to 3.7 to 3.9?
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@tiran tiran added the needs backport to 3.9 label May 27, 2020
@tiran
tiran merged commit db5aed9 into python:master May 27, 2020
@miss-islington

miss-islington commented May 27, 2020

Copy link
Copy Markdown
Contributor

Thanks @tiran for the PR 🌮🎉.. I'm working now to backport this PR to: 3.9.
🐍🍒⛏🤖
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@bedevere-bot

bedevere-bot commented May 27, 2020

Copy link
Copy Markdown

@tiran: Please replace # with GH- in the commit message next time. Thanks!
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@tiran
tiran deleted the bpo-40791-openssl-compare-digest branch May 27, 2020 19:50
@bedevere-bot bedevere-bot removed the awaiting merge label May 27, 2020
@miss-islington

miss-islington commented May 27, 2020

Copy link
Copy Markdown
Contributor

Sorry, @tiran, I could not cleanly backport this to 3.9 due to a conflict.
Please backport using cherry_picker on command line.
cherry_picker db5aed931f8a617f7b63e773f62db468fe9c5ca1 3.9
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@miss-islington miss-islington assigned tiran May 27, 2020
tiran added a commit to tiran/cpython that referenced this pull request May 27, 2020
@tiran
[3.9] bpo-40791: Use CRYPTO_memcmp() for compare_digest (pythonGH-20456)
62c27b8 
hashlib.compare_digest uses OpenSSL's CRYPTO_memcmp() function
when OpenSSL is available.

Note: The _operator module is a builtin module. I don't want to add
libcrypto dependency to libpython. Therefore I duplicated the wrapper
function and added a copy to _hashopenssl.c..
(cherry picked from commit db5aed9)

Co-authored-by: Christian Heimes <[email protected]>
@bedevere-bot bedevere-bot removed the needs backport to 3.9 label May 27, 2020
@bedevere-bot

bedevere-bot commented May 27, 2020

Copy link
Copy Markdown

GH-20461 is a backport of this pull request to the 3.9 branch.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
miss-islington pushed a commit that referenced this pull request May 28, 2020
@tiran
[3.9] bpo-40791: Use CRYPTO_memcmp() for compare_digest (GH-20456) (G…
8183e11 
…H-20461)

hashlib.compare_digest uses OpenSSL's CRYPTO_memcmp() function
when OpenSSL is available.

Note: The _operator module is a builtin module. I don't want to add
libcrypto dependency to libpython. Therefore I duplicated the wrapper
function and added a copy to _hashopenssl.c..
(cherry picked from commit db5aed9)

Co-authored-by: Christian Heimes <[email protected]>
@ssbr ssbr mannequin mentioned this pull request Aug 24, 2023
hmac.compare_digest could try harder to be constant-time. #84968
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@gpshead gpshead gpshead approved these changes

Uh oh!

There was an error while loading. Please reload this page.

Assignees

@tiran tiran

Labels

type-feature A feature request or enhancement type-security A security issue

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

5 participants

@tiran @miss-islington @bedevere-bot @gpshead @the-knights-who-say-ni
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.