2061
Consider an example hardware module that checks a user-provided password to grant access to a
user. The user-provided password is compared against a golden value in a byte-by-byte manner.
Example Language: Verilog (Bad)
always_comb @ (posedge clk)
begin
assign check_pass[3:0] = 4'b0;
for (i = 0; i < 4; i++) begin
if (entered_pass[(i*8 - 1) : i] eq golden_pass([i*8 - 1) : i])
assign check_pass[i] = 1;
continue;
else
assign check_pass[i] = 0;
break;
end
assign grant_access = (check_pass == 4'b1111) ? 1'b1: 1'b0;
end
Since the code breaks on an incorrect entry of password, an attacker can guess the correct
password for that byte-check iteration with few repeat attempts.
To fix this weakness, either the comparison of the entire string should be done all at once, or the
attacker is not given an indication whether pass or fail happened by allowing the comparison to run
through all bits before the grant_access signal is set.
Example Language: (Good)
always_comb @ (posedge clk)
begin
assign check_pass[3:0] = 4'b0;
for (i = 0; i < 4; i++) begin
if (entered_pass[(i*8 - 1) : i] eq golden_pass([i*8 -1) : i])
assign check_pass[i] = 1;
continue;
else
assign check_pass[i] = 0;
continue;
end
assign grant_access = (check_pass == 4'b1111) ? 1'b1: 1'b0;
end
Observed Examples
Reference Description
CVE-2019-10482 Smartphone OS uses comparison functions that are not in constant time,
allowing side channels
https://www.cve.org/CVERecord?id=CVE-2019-10482
CVE-2019-10071 Java-oriented framework compares HMAC signatures using String.equals()
instead of a constant-time algorithm, causing timing discrepancies
https://www.cve.org/CVERecord?id=CVE-2019-10071
CVE-2014-0984 Password-checking function in router terminates validation of a password entry
when it encounters the first incorrect character, which allows remote attackers
to obtain passwords via a brute-force attack that relies on timing differences in
responses to incorrect password guesses, aka a timing side-channel attack.
https://www.cve.org/CVERecord?id=CVE-2014-0984
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
CWE Version 4.14
CWE-1255: Comparison Logic is Vulnerable to Power Side-Channel Attacks
CWE-1255: Comparison Logic is Vulnerable to Power Side-Channel Attacks