crypto: re-add crypto.timingSafeEqual #8304

not-an-aardvark · 2016-08-27T19:32:51Z

Checklist

make -j4 test (UNIX), or vcbuild test nosign (Windows) passes
tests and/or benchmarks are included
documentation is changed or added
commit message follows commit guidelines

Affected core subsystem(s)

crypto test

Description of change

This re-adds crypto.timingSafeEqual, which was previously reverted due to test failures and concerns that the implementation might not be timing-safe.

~~Some investigation is still needed to determine why the tests are failing on ARM systems.~~

This reverts commit 0764bc4.

Trott · 2016-08-27T20:52:41Z

CI: https://ci.nodejs.org/job/node-test-pull-request/3860/

not-an-aardvark · 2016-08-27T21:49:16Z

Looks like the arm tests are failing like before, but linux is working now.

One of the arm tests had a t-value of -32 (i.e. checking unequal buffers took significantly longer than checking equal buffers). This is the opposite of what was happening on linux, so it seems unlikely to be the same problem.

not-an-aardvark · 2016-08-28T00:54:18Z

I added a temporary console.log to output more detailed info if the tests fail.

I don't have access to any ARM hardware, so debugging/reproducing this locally might be tricky. (I suppose I could look into emulating one.)

Trott · 2016-08-28T03:10:25Z

Here's a run of the test 100 times on armv7-wheezy. (Hopefully I did it right. It's building right now...) https://ci.nodejs.org/job/node-stress-single-test/871/nodes=armv7-wheezy/console

not-an-aardvark · 2016-08-28T03:26:33Z

Wow, that's a lot of numbers. Output for posterity

not-an-aardvark · 2016-08-28T06:14:48Z

So I'm not sure whether this is related to the test failures, but I noticed that a vast majority of the benchmark times (over 98%) ended with the digit 1. Is this just a known quirk of process.hrtime()?

Trott · 2016-08-28T06:21:11Z

@nodejs/crypto @nodejs/v8

not-an-aardvark · 2016-08-28T06:59:49Z

Of the 52 times that the previous test failed, all of the t-values were positive numbers between 3 and 7.

I pushed another test commit to flip the order of the benchmarks; could we run another stress-test? If the problem is caused by a security issue with the timingSafeEqual implementation, we would expect the t-values to still be positive numbers after swapping. If the problem is caused by something else (e.g. V8 optimization), the t-values will be negative numbers after swapping.

addaleax · 2016-08-28T07:03:12Z

here you go: https://ci.nodejs.org/job/node-stress-single-test/872/nodes=armv7-wheezy/console

not-an-aardvark · 2016-08-28T07:15:24Z

That time all the t-values were numbers between -3 and -7, i.e. the comparisons between unequal buffers took longer.

Based on that, I'm pretty confident that this is not a security issue; whichever pair of buffers is compared first ends up with longer benchmarks, regardless of the actual contents of the buffers.

not-an-aardvark · 2016-08-28T07:31:26Z

Pushed another commit to alternate the order of the benchmarks on each iteration.

(This might not actually solve this issue, depending on whether it's only the first benchmark overall that matters, or the first benchmark of each iteration. But it's probably worth trying anyway since it would be nice to have non-flaky tests even if it's not a security problem.)

addaleax · 2016-08-28T07:32:39Z

https://ci.nodejs.org/job/node-stress-single-test/873/nodes=armv7-wheezy/console

not-an-aardvark · 2016-08-28T07:45:07Z

Whoa, that didn't help; that time they all failed with positive t-values.

It's interesting that before that change, the test was failing almost exactly half of the time. I'm guessing there's some optimization that was kicking in at a random point, causing the test to fail if it kicked in between invocations, and pass if it kicked in after a pair of invocations is finished.

(I remember we reached something similar to this conclusion last time and tried manually optimizing the function without success.)

not-an-aardvark · 2016-08-28T07:59:45Z

To prevent V8 from optimizing the cases differently, I split the runBenchmark function into runEqualBenchmark and runUnequalBenchmark.

(This was also attempted in #8203 (comment), but it seems like there weren't any timing failures on ARM during that CI run, so it might solve the issue.)

addaleax · 2016-08-28T08:02:48Z

https://ci.nodejs.org/job/node-stress-single-test/874/nodes=armv7-wheezy/console

not-an-aardvark · 2016-08-28T08:12:20Z

That version passed 96/100 times. 🎉

I have no idea what happened with the 4 failures though; t-values of 6, -31, -33, and 3.

not-an-aardvark · 2016-08-28T19:44:18Z

I think this is ready for review; the tests are slightly flaky on ARM, but they seem to pass somewhat consistently on other platforms, and we have fairly good reason to believe that the inconsistencies are not a security problem.

(The implementation in this PR is the same as in #8040; only the tests have changed.)

Trott · 2016-08-30T02:11:27Z

I guess let's start with a regular CI run: https://ci.nodejs.org/job/node-test-pull-request/3881/

not-an-aardvark · 2016-08-30T02:42:09Z

Two relevant failures:

jasnell · 2016-08-30T03:15:29Z

Woo! tentative LGTM assuming CI looks green.

not-an-aardvark · 2016-09-06T23:35:07Z

There's no big rush, but I'd like to keep the process moving along on this PR, if possible. Is there anything I can do to advance it, or are we just waiting for people to review it at this point?

addaleax · 2016-09-06T23:42:34Z

LGTM

And maybe /cc @AndreasMadsen and/or @fhinkel for reviews if they have the time? I wouldn’t hold the PR up about that but it might be good to get other math-y looks.

jasnell · 2016-09-07T00:16:13Z

Let's give it another 24 hours at least.... and perhaps another dozen or so CI runs ;-) lol (kidding about the last bit).

not-an-aardvark · 2016-09-07T22:22:15Z

Is it worth running the CI again now that the Raspberry Pi machines are no longer out of commission? If this test is going to break the build again for some reason, it would be better to find now rather than after the PR is merged.

Trott · 2016-09-07T22:30:51Z

CI: https://ci.nodejs.org/job/node-test-pull-request/3962/

jasnell · 2016-09-07T22:31:30Z

ha! I started one at the exact moment @Trott did. Cancelled mine!

Trott · 2016-09-07T22:43:49Z

@not-an-aardvark Can you get in touch with me out-of-band? I want to talk about the Collaborator onboarding stuff, but don't want to muddy up this issue with a bunch of irrelevant back-and-forth. Any of these work for me:

email: rtrott@gmail.com
Twitter: @Trott
Freenode IRC: Trott

Or if you'd prefer some other mechanism to communicate, let me know.

Thanks!

Trott · 2016-09-07T23:22:39Z

CI is all green except for the perma-yellow AIX, so I think this is good to land.

Reinstate crypto.timingSafeEqual() which was reverted due to test issues. The flaky test issues are resolved in this new changeset. PR-URL: nodejs#8304 Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Anna Henningsen <anna@addaleax.net>

Trott · 2016-09-07T23:32:37Z

Landed in 079accc

🎉

Thanks for persevering, @not-an-aardvark!

bnoordhuis · 2016-09-09T06:39:41Z

Sorry to be a party pooper but it seems the test is still flaky: https://ci.nodejs.org/job/node-test-commit-linux/5019/nodes=debian8-x86/consoleText

not-an-aardvark · 2016-09-09T06:41:43Z

@bnoordhuis Yep, there is a PR open to fix this (see #8456).

Reinstate crypto.timingSafeEqual() which was reverted due to test issues. The flaky test issues are resolved in this new changeset. PR-URL: #8304 Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Anna Henningsen <anna@addaleax.net>

Notable changes: * crypto: Added `crypto.timingSafeEqual()`. (not-an-aardvark) #8304 * events: Made the "max event listeners" memory leak warning more accessible. (Anna Henningsen) #8298 * promises: Unhandled rejections now emit a process warning after the first tick. (Benjamin Gruenbaum) #8223 * repl: Added auto alignment for `.editor` mode. (Prince J Wesley) #8241 * util: Some functionality has been added to `util.inspect()`: - Returning `this` from a custom inspect function now works. (Anna Henningsen) #8174 - Added support for Symbol-based custom inspection methods. (Anna Henningsen) #8174 Refs: #8428 Refs: #8457 PR-URL: #8466

Notable changes: * crypto: Added `crypto.timingSafeEqual()`. (not-an-aardvark) nodejs#8304 * events: Made the "max event listeners" memory leak warning more accessible. (Anna Henningsen) nodejs#8298 * promises: Unhandled rejections now emit a process warning after the first tick. (Benjamin Gruenbaum) nodejs#8223 * repl: Added auto alignment for `.editor` mode. (Prince J Wesley) nodejs#8241 * util: Some functionality has been added to `util.inspect()`: - Returning `this` from a custom inspect function now works. (Anna Henningsen) nodejs#8174 - Added support for Symbol-based custom inspection methods. (Anna Henningsen) nodejs#8174 Refs: nodejs#8428 Refs: nodejs#8457 PR-URL: nodejs#8466

Notable changes: * crypto: Added `crypto.timingSafeEqual()`. (not-an-aardvark) nodejs/node#8304 * events: Made the "max event listeners" memory leak warning more accessible. (Anna Henningsen) nodejs/node#8298 * promises: Unhandled rejections now emit a process warning after the first tick. (Benjamin Gruenbaum) nodejs/node#8223 * repl: Added auto alignment for `.editor` mode. (Prince J Wesley) nodejs/node#8241 * util: Some functionality has been added to `util.inspect()`: - Returning `this` from a custom inspect function now works. (Anna Henningsen) nodejs/node#8174 - Added support for Symbol-based custom inspection methods. (Anna Henningsen) nodejs/node#8174 Signed-off-by: Ilkka Myller <ilkka.myller@nodefield.com>

crypto.timingSafeEqual() has been added in v6.6.0 cf. #8304 This commit adds the metadata that will display "Added in: v6.6.0" and that can later be checked on https://nodejs.org/api/crypto.html#crypto_crypto_timingsafeequal_a_b PR-URL: #8796 Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: Teddy Katz <teddy.katz@gmail.com> Reviewed-By: Anna Henningsen <anna@addaleax.net>

not-an-aardvark added 2 commits August 27, 2016 15:28

Revert "Revert "crypto: add crypto.timingSafeEqual""

627cbc0

This reverts commit 0764bc4.

test: fix timing flake for crypto.timingSafeEqual

7e9869a

nodejs-github-bot added crypto Issues and PRs related to the crypto subsystem. c++ Issues and PRs that require attention from people who are familiar with C++. labels Aug 27, 2016

not-an-aardvark mentioned this pull request Aug 27, 2016

WIP: test: force garbage collection on crypto timing test #8203

Closed

2 tasks

squash: temporarily log detailed results if test fails

ca0e08a

squash: flip the order of the benchmarks

03ff774

squash: change the order of the benchmarks every iteration

0c2077c

squash: split into two benchmark functions

872e563

squash: remove temporary logging

e484b5f

squash: add linebreaks in docs

3c5ba3c

Trott closed this Sep 7, 2016

not-an-aardvark deleted the timing-safe-equal-v2 branch September 7, 2016 23:34

not-an-aardvark mentioned this pull request Sep 8, 2016

test: make crypto.timingSafeEqual test less flaky #8456

Closed

3 tasks

ChALkeR mentioned this pull request Sep 12, 2016

Crypto library should have a constant-time equality function #3043

Closed

ChALkeR mentioned this pull request Sep 15, 2016

Use crypto.timingSafeEqual for fixedTimeComparison hapijs/cryptiles#24

Closed

madarche mentioned this pull request Sep 26, 2016

Document crypto.timingSafeEqual() added in v6.6.0 #8796

Closed

2 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

crypto: re-add crypto.timingSafeEqual #8304

crypto: re-add crypto.timingSafeEqual #8304

not-an-aardvark commented Aug 27, 2016 •

edited

Loading

Trott commented Aug 27, 2016

not-an-aardvark commented Aug 27, 2016

not-an-aardvark commented Aug 28, 2016

Trott commented Aug 28, 2016

not-an-aardvark commented Aug 28, 2016

not-an-aardvark commented Aug 28, 2016

Trott commented Aug 28, 2016

not-an-aardvark commented Aug 28, 2016

addaleax commented Aug 28, 2016

not-an-aardvark commented Aug 28, 2016 •

edited

Loading

not-an-aardvark commented Aug 28, 2016

addaleax commented Aug 28, 2016

not-an-aardvark commented Aug 28, 2016 •

edited

Loading

not-an-aardvark commented Aug 28, 2016

addaleax commented Aug 28, 2016

not-an-aardvark commented Aug 28, 2016 •

edited

Loading

not-an-aardvark commented Aug 28, 2016 •

edited

Loading

Trott commented Aug 30, 2016

not-an-aardvark commented Aug 30, 2016

jasnell commented Aug 30, 2016

not-an-aardvark commented Sep 6, 2016

addaleax commented Sep 6, 2016

jasnell commented Sep 7, 2016

not-an-aardvark commented Sep 7, 2016 •

edited

Loading

Trott commented Sep 7, 2016

jasnell commented Sep 7, 2016

Trott commented Sep 7, 2016

Trott commented Sep 7, 2016

Trott commented Sep 7, 2016

bnoordhuis commented Sep 9, 2016

not-an-aardvark commented Sep 9, 2016 •

edited

Loading

crypto: re-add crypto.timingSafeEqual #8304

crypto: re-add crypto.timingSafeEqual #8304

Conversation

not-an-aardvark commented Aug 27, 2016 • edited Loading

Checklist

Affected core subsystem(s)

Description of change

Trott commented Aug 27, 2016

not-an-aardvark commented Aug 27, 2016

not-an-aardvark commented Aug 28, 2016

Trott commented Aug 28, 2016

not-an-aardvark commented Aug 28, 2016

not-an-aardvark commented Aug 28, 2016

Trott commented Aug 28, 2016

not-an-aardvark commented Aug 28, 2016

addaleax commented Aug 28, 2016

not-an-aardvark commented Aug 28, 2016 • edited Loading

not-an-aardvark commented Aug 28, 2016

addaleax commented Aug 28, 2016

not-an-aardvark commented Aug 28, 2016 • edited Loading

not-an-aardvark commented Aug 28, 2016

addaleax commented Aug 28, 2016

not-an-aardvark commented Aug 28, 2016 • edited Loading

not-an-aardvark commented Aug 28, 2016 • edited Loading

Trott commented Aug 30, 2016

not-an-aardvark commented Aug 30, 2016

jasnell commented Aug 30, 2016

not-an-aardvark commented Sep 6, 2016

addaleax commented Sep 6, 2016

jasnell commented Sep 7, 2016

not-an-aardvark commented Sep 7, 2016 • edited Loading

Trott commented Sep 7, 2016

jasnell commented Sep 7, 2016

Trott commented Sep 7, 2016

Trott commented Sep 7, 2016

Trott commented Sep 7, 2016

bnoordhuis commented Sep 9, 2016

not-an-aardvark commented Sep 9, 2016 • edited Loading

not-an-aardvark commented Aug 27, 2016 •

edited

Loading

not-an-aardvark commented Aug 28, 2016 •

edited

Loading

not-an-aardvark commented Aug 28, 2016 •

edited

Loading

not-an-aardvark commented Aug 28, 2016 •

edited

Loading

not-an-aardvark commented Aug 28, 2016 •

edited

Loading

not-an-aardvark commented Sep 7, 2016 •

edited

Loading

not-an-aardvark commented Sep 9, 2016 •

edited

Loading