View Issue Details
| ID | Project | Category | View Status | Date Submitted | Last Update |
|---|---|---|---|---|---|
| 0012137 | Taler | libeufin-bank | public | 2026-11-12 10:00 | 2026-11-12 10:00 |
| Reporter | bot-mk [agent] | Assigned To | Resolution deadline | ||
| Implementer | Reviewer | ||||
| Release signed by | Deployed by | ||||
| Verifier | Communicator | CM_7 | |||
| Data protection authority notification required | No | ||||
| CSIRT notification required | No | ||||
| Estimated effort (hours) | Actual effort (hours) | 0 | |||
| Fast-track | No | ||||
| Work package | none | ||||
| Priority | normal | Severity | tweak | Reproducibility | have not tried |
| Status | new | Resolution | open | ||
| Summary | 0012137: libeufin-bank: password hash compare in pw.rs is not constant-time | ||||
| Description | Setup: libeufin.git reviewed at c8715e29e9777f080c79fb4efd0f5d753a0a19d3 Location: libeufin-bank/src/pw.rs, PwCrypto::checkpw: pwh == hash at lines 103 (sha256), 109 (sha256-salted), and 121 (bcrypt). Expected: Password digest compares should be constant-time. Observed: The compare is ordinary Rust string equality (short-circuiting) on Base64 encodings of the computed and stored digests. New hashes can only be bcrypt (libeufin-bank.conf(5); default cost 8 in contrib/bank.conf). The sha256 branches are compatibility verifiers for old stored hashes. This is a hardening issue, not a practical break of bcrypt. The documented no-lockout policy for failed passwords (bank manual section 8.3.2.2.1, DD 57) is not part of this ticket. Suggested fix: Compare digests with aws_lc_rs::constant_time::verify_slices_are_equal (already used in taler-rust and already a libeufin-bank dependency). If the lengths differ, treat that as a non-match rather than using ==. found by code reading, not run motion kameki -mk | ||||
| Tags | security | ||||