9d58253588
This code (or a version of it) is being shared by at least nova and keystonemiddleware and it seems like a good idea to move it to being common shared code (especially due to the importance of getting this code correct). This adds an initial secretutils and adds tests for it. Change-Id: Ia603202a065d5b345608e712f63f7af21fd74dea
36 lines
1.3 KiB
Python
36 lines
1.3 KiB
Python
# All Rights Reserved.
|
|
#
|
|
# Licensed under the Apache License, Version 2.0 (the "License"); you may
|
|
# not use this file except in compliance with the License. You may obtain
|
|
# a copy of the License at
|
|
#
|
|
# http://www.apache.org/licenses/LICENSE-2.0
|
|
#
|
|
# Unless required by applicable law or agreed to in writing, software
|
|
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
|
|
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
|
|
# License for the specific language governing permissions and limitations
|
|
# under the License.
|
|
|
|
import hmac
|
|
|
|
|
|
try:
|
|
constant_time_compare = hmac.compare_digest
|
|
except AttributeError:
|
|
def constant_time_compare(first, second):
|
|
"""Returns True if both string inputs are equal, otherwise False.
|
|
|
|
This function should take a constant amount of time regardless of
|
|
how many characters in the strings match. This function uses an
|
|
approach designed to prevent timing analysis by avoiding
|
|
content-based short circuiting behaviour, making it appropriate
|
|
for cryptography.
|
|
"""
|
|
if len(first) != len(second):
|
|
return False
|
|
result = 0
|
|
for x, y in zip(first, second):
|
|
result |= ord(x) ^ ord(y)
|
|
return result == 0
|