Merge pull request #30 from afk11/2.x-hmac

[2.x backport] Avoid timing side-channels in signature validation
99designs · Jan 19, 2017 · 08ed0a0 · 08ed0a0
2 parents c47fc57 + c47fec8
commit 08ed0a0
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 1 deletion.
diff --git a/composer.json b/composer.json
@@ -21,6 +21,7 @@
     },
     "require": {
         "php": ">=5.3.3",
+        "paragonie/random_compat": "^1.0|^2.0",
         "symfony/http-foundation": "~2.5|~3.0"
     },
     "require-dev": {

diff --git a/src/Verification.php b/src/Verification.php
@@ -39,7 +39,8 @@ public function isValid()
     private function signatureMatches()
     {
         try {
-            return $this->expectedSignatureBase64() === $this->providedSignatureBase64();
+            $random = random_bytes(32);
+            return hash_hmac('sha256', $this->expectedSignatureBase64(), $random, true) === hash_hmac('sha256', $this->providedSignatureBase64(), $random, true);
         } catch (SignatureParseException $e) {
             return false;
         } catch (KeyStoreException $e) {