fast_secure_compare 0.0.2

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA1:
+  metadata.gz: 1b49fc77195a730ff81966f32d327f2e4eafda4b
+  data.tar.gz: cc68be175b411a1d1f6867d8e9a7f0443269be40
+SHA512:
+  metadata.gz: d1bd92fc4dcc15967c9e2dc614bf492c6722c10e898fc3e5a8cf2121739ec8da1dd12b7093e5daddcfaed20f08c2083ec4a984b8ba7620ae25b16186d193ad92
+  data.tar.gz: f473788cc8c4c789f02d9262593290f5e8e0eb4a12024d73f0099592ce622642215d367bb0ae17b4679e74bb48ac9da5c08e7377bd4245dfe8b4950a34f2592e

data/LICENSE

@@ -0,0 +1,19 @@
+Copyright (c) 2014 Daniel Axtens
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

data/README.md

@@ -0,0 +1,39 @@
+This gem provides a simple, fast way to do string comparisons that resist timing attacks.
+
+# What is a timing attack? #
+A timing attack is an attack on a system that determines secret information based on how long an operation takes.
+
+Timing attacks are particularly prevalent (and dangerous) in cryptographic operations, but they can also sneak into other types of operation.
+
+In particular, any time you are **comparing user specified input with a secret**, you should consider whether or not you are exposing yourself to a timing attack.
+
+The attack is probably best described by [Nate Lawson](http://rdist.root.org/2010/07/19/exploiting-remote-timing-attacks/):
+
+> The attack is very simple. You repeatedly send guesses about a secret value to the server, which rejects them as incorrect. However, if your first byte of the guess is correct, it takes a very slightly longer time to return the error. With many measurements and some filtering, you can distinguish this difference.
+
+Therefore, it's important that the amount of time these operations take depends *only* on the length of the user's input, and *not* on any characteristic of the secret data.
+
+# How does this gem help? Why should I use it rather than rolling my own? #
+
+This gem provides a secure comparison function that is:
+
+ - very simple: 1 class, 1 method
+ - fast: it uses a C back-end rather than a pure Ruby implementation.
+ - portable: the C code is platform independent
+
+Furthermore, unlike some other secure comparison fuctions, the code does not require that the strings are the same length, and should not leak the length of the string if the string lengths do not match.
+
+If you're interested in seeing how much faster you can make your code by using this gem, check out the demo folder.
+
+# How do I use this gem in my code? #
+
+```ruby
+
+import 'fast_secure_compare'
+
+FastSecureCompare.compare(my_secret, user_input)
+```
+
+# Is there anything else I should know? #
+
+The gem is not foolproof. In particular, it can't protect you against anything designed to exploit cache misses or any other more elaborate form of timing attack. However, none of the existing pure Ruby secure_compare functions do either.

data/Rakefile

@@ -0,0 +1,21 @@
+# shamelessly ripped off https://github.com/cotag/http-parser/blob/master/Rakefile
+
+require 'rubygems'
+require 'rake'
+require 'rspec/core/rake_task'
+
+task :default => [:compile, :test]
+
+task :compile do
+    protect = ['secure_compare.c']
+    Dir["ext/fast_secure_compare/**/*"].each do |file|
+        begin
+            next if protect.include? File.basename(file)
+            FileUtils.rm file
+        rescue
+        end
+    end
+    system 'cd ext && rake'
+end
+
+RSpec::Core::RakeTask.new(:test)

data/ext/Rakefile

@@ -0,0 +1,3 @@
+require 'ffi-compiler/compile_task'
+
+FFI::Compiler::CompileTask.new('fast_secure_compare')

data/ext/fast_secure_compare/secure_compare.c

@@ -0,0 +1,15 @@
+int secure_compare_bytes(const unsigned char * secret, unsigned int secret_len, 
+                         const unsigned char * input, unsigned int input_len) {
+
+    int input_pos;
+    int secret_pos = 0;
+    int result = secret_len - input_len;
+    // make sure our time isn't dependent on secret_len, and only dependent
+    // on input_len
+    for (input_pos = 0; input_pos < input_len; input_pos++) {
+        result |= input[input_pos] ^ secret[secret_pos];
+        secret_pos = (secret_pos + 1) % secret_len;
+    }
+
+    return result;
+}

data/fast_secure_compare.gemspec

@@ -0,0 +1,27 @@
+Gem::Specification.new do |s|
+  s.name        = 'fast_secure_compare'
+  s.version     = '0.0.2'
+  s.date        = '2014-08-17'
+  s.summary     = "A fast, simple way to do constant time string comparisons."
+  s.description = "A secure_comparison function implemented in C for blazing speed."
+  s.authors     = ["Daniel Axtens"]
+  s.email       = 'daniel@axtens.net'
+  s.homepage    =
+    'https://github.com/daxtens/fast_secure_compare'
+  s.license       = 'MIT'
+
+
+  s.add_dependency 'ffi-compiler', '>= 0.0.2'
+  s.add_dependency 'rake'
+
+  s.add_development_dependency 'rspec'
+  
+  s.files = Dir["{lib}/**/*"] + %w(Rakefile fast_secure_compare.gemspec README.md LICENSE)
+  s.files += ["ext/fast_secure_compare/secure_compare.c"]
+  s.test_files = Dir["spec/**/*"]
+  s.extra_rdoc_files = ["README.md"]
+
+  s.extensions << "ext/Rakefile"
+  s.require_paths = ["lib"]
+end
+

data/lib/fast_secure_compare.rb

@@ -0,0 +1,17 @@
+require 'ffi'
+require 'ffi-compiler/loader'
+
+module FastSecureCompare
+  extend FFI::Library
+  ffi_lib FFI::Compiler::Loader.find('fast_secure_compare')
+  
+  attach_function :secure_compare_bytes, [:pointer, :uint, :pointer, :uint], :int
+
+  def self.compare(secret, input)
+    sBuf = FFI::MemoryPointer.new(:char, secret.size)
+    sBuf.put_bytes(0, secret)
+    iBuf = FFI::MemoryPointer.new(:char, input.size)
+    iBuf.put_bytes(0, input)
+    secure_compare_bytes(secret, secret.size, input, input.size) == 0
+  end
+end

data/spec/fast_secure_compare_spec.rb

@@ -0,0 +1,17 @@
+require 'fast_secure_compare'
+
+describe FastSecureCompare, "#compare" do
+    it "returns true on equal strings" do
+      expect(FastSecureCompare.compare("aaa","aaa")).to eq(true)
+     end
+    it "returns false on an empty string" do
+      expect(FastSecureCompare.compare("aaa","")).to eq(false)
+    end
+    it "returns false on different strings of different length" do
+      expect(FastSecureCompare.compare("aaa","a")).to eq(false)
+      expect(FastSecureCompare.compare("aaa","aaaaaa")).to eq(false)
+    end
+    it "returns false on different strings of equal length" do
+      expect(FastSecureCompare.compare("aaa","bbb")).to eq(false)
+    end
+end

metadata

@@ -0,0 +1,97 @@
+--- !ruby/object:Gem::Specification
+name: fast_secure_compare
+version: !ruby/object:Gem::Version
+  version: 0.0.2
+platform: ruby
+authors:
+- Daniel Axtens
+autorequire: 
+bindir: bin
+cert_chain: []
+date: 2014-08-17 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: ffi-compiler
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - '>='
+      - !ruby/object:Gem::Version
+        version: 0.0.2
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - '>='
+      - !ruby/object:Gem::Version
+        version: 0.0.2
+- !ruby/object:Gem::Dependency
+  name: rake
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - '>='
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - '>='
+      - !ruby/object:Gem::Version
+        version: '0'
+- !ruby/object:Gem::Dependency
+  name: rspec
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - '>='
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - '>='
+      - !ruby/object:Gem::Version
+        version: '0'
+description: A secure_comparison function implemented in C for blazing speed.
+email: daniel@axtens.net
+executables: []
+extensions:
+- ext/Rakefile
+extra_rdoc_files:
+- README.md
+files:
+- lib/fast_secure_compare.rb
+- Rakefile
+- fast_secure_compare.gemspec
+- README.md
+- LICENSE
+- ext/fast_secure_compare/secure_compare.c
+- spec/fast_secure_compare_spec.rb
+- ext/Rakefile
+homepage: https://github.com/daxtens/fast_secure_compare
+licenses:
+- MIT
+metadata: {}
+post_install_message: 
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - '>='
+    - !ruby/object:Gem::Version
+      version: '0'
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - '>='
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubyforge_project: 
+rubygems_version: 2.0.6
+signing_key: 
+specification_version: 4
+summary: A fast, simple way to do constant time string comparisons.
+test_files:
+- spec/fast_secure_compare_spec.rb
+has_rdoc: