From 2eeacada709b08fbdcfe0f96e87b82099def65e8 Mon Sep 17 00:00:00 2001 From: Finn Glas Date: Wed, 27 May 2026 23:15:48 +0200 Subject: [PATCH] use constant-time password verification The password verification in RootKeys compared hashed passwords byte-by-byte with an early return on mismatch. This leaks how many leading bytes match through timing, weakening the protection that bcrypt provides. Replace the loop with subtle::ConstantTimeEq::ct_eq, which is already used elsewhere in this crate (backups.rs, FPGA key check). Signed-off-by: Finn Glas --- services/root-keys/src/implementation.rs | 24 ++++-------------------- 1 file changed, 4 insertions(+), 20 deletions(-) diff --git a/services/root-keys/src/implementation.rs b/services/root-keys/src/implementation.rs index 219a85496..67c71e051 100644 --- a/services/root-keys/src/implementation.rs +++ b/services/root-keys/src/implementation.rs @@ -882,28 +882,12 @@ impl<'a> RootKeys { unsafe { match pw_type { PasswordType::Boot => { - if (*pcache_ptr).hashed_boot_pw_valid == 1 { - for (&src, &dst) in digest.iter().zip((*pcache_ptr).hashed_boot_pw.iter()) { - if dst != src { - return false; - } - } - true - } else { - false - } + (*pcache_ptr).hashed_boot_pw_valid == 1 + && bool::from(digest.ct_eq(&(*pcache_ptr).hashed_boot_pw)) } PasswordType::Update => { - if (*pcache_ptr).hashed_update_pw_valid == 1 { - for (&src, &dst) in digest.iter().zip((*pcache_ptr).hashed_update_pw.iter()) { - if dst != src { - return false; - } - } - true - } else { - false - } + (*pcache_ptr).hashed_update_pw_valid == 1 + && bool::from(digest.ct_eq(&(*pcache_ptr).hashed_update_pw)) } } }