{"action":"created","issue":{"url":"https://api.github.com/repos/jcmturner/gokrb5/issues/215","repository_url":"https://api.github.com/repos/jcmturner/gokrb5","labels_url":"https://api.github.com/repos/jcmturner/gokrb5/issues/215/labels{/name}","comments_url":"https://api.github.com/repos/jcmturner/gokrb5/issues/215/comments","events_url":"https://api.github.com/repos/jcmturner/gokrb5/issues/215/events","html_url":"https://github.com/jcmturner/gokrb5/issues/215","id":375063665,"node_id":"MDU6SXNzdWUzNzUwNjM2NjU=","number":215,"title":"Replace bytes.Equal with subtle.ConstantTimeCompare","user":{"login":"dlespiau","id":7986,"node_id":"MDQ6VXNlcjc5ODY=","avatar_url":"https://avatars2.githubusercontent.com/u/7986?v=4","gravatar_id":"","url":"https://api.github.com/users/dlespiau","html_url":"https://github.com/dlespiau","followers_url":"https://api.github.com/users/dlespiau/followers","following_url":"https://api.github.com/users/dlespiau/following{/other_user}","gists_url":"https://api.github.com/users/dlespiau/gists{/gist_id}","starred_url":"https://api.github.com/users/dlespiau/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dlespiau/subscriptions","organizations_url":"https://api.github.com/users/dlespiau/orgs","repos_url":"https://api.github.com/users/dlespiau/repos","events_url":"https://api.github.com/users/dlespiau/events{/privacy}","received_events_url":"https://api.github.com/users/dlespiau/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2018-10-29T15:09:15Z","updated_at":"2018-10-29T19:35:25Z","closed_at":null,"author_association":"NONE","body":"It's nice to use constant time comparison functions in crypto code so the time it takes for the comparison to fail cannot be used to deduce how many bytes were correct. The `crypto/subtle` package has exactly that! https://golang.org/pkg/crypto/subtle/#ConstantTimeCompare"},"comment":{"url":"https://api.github.com/repos/jcmturner/gokrb5/issues/comments/434049234","html_url":"https://github.com/jcmturner/gokrb5/issues/215#issuecomment-434049234","issue_url":"https://api.github.com/repos/jcmturner/gokrb5/issues/215","id":434049234,"node_id":"MDEyOklzc3VlQ29tbWVudDQzNDA0OTIzNA==","user":{"login":"jcmturner","id":10795321,"node_id":"MDQ6VXNlcjEwNzk1MzIx","avatar_url":"https://avatars3.githubusercontent.com/u/10795321?v=4","gravatar_id":"","url":"https://api.github.com/users/jcmturner","html_url":"https://github.com/jcmturner","followers_url":"https://api.github.com/users/jcmturner/followers","following_url":"https://api.github.com/users/jcmturner/following{/other_user}","gists_url":"https://api.github.com/users/jcmturner/gists{/gist_id}","starred_url":"https://api.github.com/users/jcmturner/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jcmturner/subscriptions","organizations_url":"https://api.github.com/users/jcmturner/orgs","repos_url":"https://api.github.com/users/jcmturner/repos","events_url":"https://api.github.com/users/jcmturner/events{/privacy}","received_events_url":"https://api.github.com/users/jcmturner/received_events","type":"User","site_admin":false},"created_at":"2018-10-29T19:35:25Z","updated_at":"2018-10-29T19:35:25Z","author_association":"OWNER","body":"Thanks for the tip!\r\nI have looked through the code for bytes.Equal and I only see it being used for comparing computed checksums with the ones provided. Given a checksum cannot be used to deduce anything about the value over which it is computed I cannot see what could usefully be figured out from the time it takes to compare checksum values. I'd be interested to know if you agree with this or not."}}
{"actor":{"display_login":"jcmturner"}}