compare password and sensitive data's in nodejs



previously I did like this to compare the sensitive data's

function validatePassword(fromDbPassword, inputPassword){
         if( fromDbPassword === inputPassword) return true;
          return false;
}


There is an attack security attack called timing attack. Hackers try to crack the encryption algorithm using the way.  So How to compare password hackers cant use the timing attack

V8,  JavaScript engine used by Node.js, tries to optimize the code you run from a performance point of view. It starts comparing the strings character by character, and once a mismatch is found, it stops the comparison operation. So the longer the attacker has right from the password, the more time it takes.


function checkApiKey (apiKeyFromDb, apiKeyReceived) { 

return cryptiles.fixedTimeComparison(apiKeyFromDb, apiKeyReceived) 

}
To solve this issue, you can use the npm module called cryptiles
exports.fixedTimeComparison = function(a, b) {


    if (typeof a !== 'string' || typeof b !== 'string') {

        return false;

    }



    let mismatch = (a.length === b.length ? 0 : 1);

    if (mismatch) {

        b = a;

    }


    for (let i = 0; i < a.length; ++i) {

        const ac = a.charCodeAt(i);

        const bc = b.charCodeAt(i);

        mismatch |= (ac ^ bc);

    }


    return (mismatch === 0);

};



Comments

Popular posts from this blog

Proxy setting in java

Using logstash to import csv json files into elasticsearch

Kibana 4 Installation and Run as a service in ubuntu