From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mailman by lists.gnu.org with archive (Exim 4.43) id 1N7rgU-0007wV-DC for mharc-grub-devel@gnu.org; Tue, 10 Nov 2009 09:27:02 -0500 Received: from mailman by lists.gnu.org with tmda-scanned (Exim 4.43) id 1N7rgQ-0007ue-2L for grub-devel@gnu.org; Tue, 10 Nov 2009 09:26:58 -0500 Received: from exim by lists.gnu.org with spam-scanned (Exim 4.43) id 1N7rgJ-0007s4-4E for grub-devel@gnu.org; Tue, 10 Nov 2009 09:26:55 -0500 Received: from [199.232.76.173] (port=37935 helo=monty-python.gnu.org) by lists.gnu.org with esmtp (Exim 4.43) id 1N7rgI-0007rr-AP for grub-devel@gnu.org; Tue, 10 Nov 2009 09:26:50 -0500 Received: from esemetz.metz.supelec.fr ([193.48.224.212]:43936) by monty-python.gnu.org with esmtps (TLS-1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.60) (envelope-from ) id 1N7rgH-000645-Lm for grub-devel@gnu.org; Tue, 10 Nov 2009 09:26:49 -0500 Received: from mx1.metz.supelec.fr (mx1.metz.supelec.fr [193.48.224.216]) by esemetz.metz.supelec.fr (8.14.1/8.14.1) with ESMTP id nAAEQjUu025334 for ; Tue, 10 Nov 2009 15:26:45 +0100 Received: from [127.0.0.1] (duboucher.rez-metz.supelec.fr [193.48.225.222] (may be forged)) by mx1.metz.supelec.fr (8.14.1/8.14.1) with ESMTP id nAAEQeFO012448 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NOT) for ; Tue, 10 Nov 2009 15:26:40 +0100 Message-ID: <4AF977DD.5090801@duboucher.eu> Date: Tue, 10 Nov 2009 15:25:33 +0100 From: Duboucher Thomas User-Agent: Thunderbird 2.0.0.23 (Windows/20090812) MIME-Version: 1.0 To: The development of GNU GRUB References: <20091109010422.GA23417@thorin> <4AF86387.7090307@gmail.com> <4AF885EE.7000709@duboucher.eu> <4AF88AEF.8010102@gmail.com> In-Reply-To: X-Enigmail-Version: 0.96.0 OpenPGP: id=A79F86A8 Content-Type: text/plain; charset=ISO-8859-1 X-Virus-Scanned: ClamAV 0.94.1/10005/Mon Nov 9 21:23:43 2009 on mx1.metz.supelec.fr X-Virus-Status: Clean X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-3.0 (esemetz.metz.supelec.fr [193.48.224.212]); Tue, 10 Nov 2009 15:26:45 +0100 (CET) X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-3.0 (mx1.metz.supelec.fr [193.48.224.216]); Tue, 10 Nov 2009 15:26:45 +0100 (CET) Content-Transfer-Encoding: quoted-printable X-MIME-Autoconverted: from 8bit to quoted-printable by esemetz.metz.supelec.fr id nAAEQjUu025334 X-detected-operating-system: by monty-python.gnu.org: GNU/Linux 2.6 (newer, 3) Subject: Re: Imminent bugfix release (1.97.1) X-BeenThere: grub-devel@gnu.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: The development of GNU GRUB List-Id: The development of GNU GRUB List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 10 Nov 2009 14:26:59 -0000 -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Bean a =E9crit : > Hi, >=20 > Oh, I just come up with a better way to do this: >=20 > typedef char grub_password_t[1024]; >=20 > int > grub_auth_strcmp (const grub_password_t s1, const grub_password_t s2) > { > char r1 =3D 0; > char r2 =3D 0; > char *p; > int i, c; >=20 > p =3D &r1; > c =3D 0; > for (i =3D 0; i < sizeof (grub_password_t); i++, s1++, s2++) > { > *p | =3D (*s1 ^ *s2); > if ((int) *s1 =3D=3D c) > { > p =3D &r2; > c =3D 0x100; > } > } >=20 > return (r1 !=3D 0); > } >=20 > The condition (int) *s1 =3D=3D c would be true exactly once. >=20 Well, it seems I lost something somewhere. I don't understand the need of doing it exactly sizeof (grub_password_t) times, except from having a perfectly symetric function. IMHO, stopping the comparison when the input buffer is done reading, or when the maximum size of a passphrase is reached does not leak any information to the attacker. So I would stick to typedef char grub_password_t[1024]; int auth_strcmp (const grub_password_t input, grub_password_t key) { int retval, it; for (it =3D retval =3D 0; it < PASSPHRASE_MAXSIZE; it++, input++, key++= ) { retval |=3D (*input !=3D *key); if (*input =3D=3D '\0') break; } return !retval; } Also, take care that it requires to check how the function is optimized; sometimes you have surprises ... ;) Thomas. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (MingW32) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iEYEARECAAYFAkr5d90ACgkQBV7eXqefhqio+QCfba54+l45DiQNyI3IzfnwgvVe tbUAnRTPI+yYSZoVZLfM9fze7c7cvRQN =3DEjYS -----END PGP SIGNATURE-----