compare password and sensitive data's in nodejs
previously I did like this to compare the sensitive data's
function validatePassword(fromDbPassword, inputPassword){
if( fromDbPassword === inputPassword) return true;
return false;
}
There is an attack security attack called timing attack. Hackers try to crack the encryption algorithm using the way. So How to compare password hackers cant use the timing attack
V8, JavaScript engine used by Node.js, tries to optimize the code you run from a performance point of view. It starts comparing the strings character by character, and once a mismatch is found, it stops the comparison operation. So the longer the attacker has right from the password, the more time it takes.
function checkApiKey (apiKeyFromDb, apiKeyReceived) {
return cryptiles.fixedTimeComparison(apiKeyFromDb, apiKeyReceived)
}
To solve this issue, you can use the npm module called cryptiles
exports.fixedTimeComparison = function(a, b) {
if (typeof a !== 'string' || typeof b !== 'string') {
return false;
}
let mismatch = (a.length === b.length ? 0 : 1);
if (mismatch) {
b = a;
}
for (let i = 0; i < a.length; ++i) {
const ac = a.charCodeAt(i);
const bc = b.charCodeAt(i);
mismatch |= (ac ^ bc);
}
return (mismatch === 0);
};
Comments
Post a Comment