4
$\begingroup$

In Laravel (a PHP framework) I can see that they calculate a HMAC with a random key over the final HMAC before comparison. This additional HMAC calculation is of course performed for both the calculated MAC and the received MAC value, using this randomized key.

Does this just supply a method of performing a "constant time" compare? Or does it add other security properties to the MAC calculation. I presume the former, but I want to be sure. Is this a known technique for performing MAC comparisons?

$\endgroup$
  • $\begingroup$ I can't think of anything else it would add to the security properties. Of course, there ought to be easier ways to do a constant time equality comparison; perhaps they are extremely paranoid about how "helpful" optimizing compilers can be. $\endgroup$ – poncho Jan 17 '15 at 19:37
  • $\begingroup$ @poncho I think it could be simpler than that; if there is no time constant comparison and there is a HMAC function it may be easier to use the latter. I'm not sure if the PHP type system would be a burden, but personally I don't see why a time constant compare wouldn't work. $\endgroup$ – Maarten Bodewes Jan 17 '15 at 19:43
  • 1
    $\begingroup$ I think symfony.com/blog/new-in-symfony-2-2-security-utilities implies that StringUtils::equals is already supposed to include protection against timing attacks. So there should be some other explanation for the additional HMAC layer? $\endgroup$ – Neil Slater Jan 17 '15 at 23:36
  • $\begingroup$ I've seen suggestions to use this as constant time comparison by people who're afraid that the compiler will optimize the usual constant time comparison code into variable time code. $\endgroup$ – CodesInChaos Jan 18 '15 at 12:48
1
$\begingroup$

The commit that added this double HMAC only says it improves "valid MAC detection", but it simultaneously adds the constant-time comparison, so likely the reason is indeed defense against timing attacks:

Improve valid MAC detection

Implement constant time string comparison as well as double HMAC verification for encryption MACs.

Double HMAC is a known technique to avoid the side channel attack, and has been recommended as a more reliable (and "simpler") alternative to constant time comparisons. I am not aware of anyone recommending both, which is pointless (they prevent the same attack) and costs even more than double HMAC - its main downside compared to constant time comparisons. On the other hand, it should not hurt, so perhaps it is done out of an abundance of caution.

|improve this answer|||||
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.