c# - 尝试登录的安全性(防止时间攻击)

Question

我遇到了一个安全问题。请看下面的伪代码

public static bool TryLogin(string email, string password)
{
    if (UserExists(email)) // here is the problem
        return false;

    var hash = GetRealPasswordHash(email);
    var hash2 = GetHash(email, password);
    return SlowEquals(hash, hash2);
}

有些人可能已经看到了这个漏洞。攻击者可能会通过网络执行时间攻击 - 检测返回答案的速度，并据此检测数据库中是否有用户!知道这一点后，攻击者现在可以检查他已知存在的用户的各种密码!

如果您没有看到问题或不认为这是一个问题(这是针对哈希，但类比问题在这里)，请解释一下:

Comparing the hashes in "length-constant" time ensures that anattacker cannot extract the hash of a password in an on-line systemusing a timing attack, then crack it off-line.

The standard way to check if two sequences of bytes (strings) are thesame is to compare the first byte, then the second, then the third,and so on. As soon as you find a byte that isn't the same for bothstrings, you know they are different and can return a negativeresponse immediately. If you make it through both strings withoutfinding any bytes that differ, you know the strings are the same andcan return a positive result. This means that comparing two stringscan take a different amount of time depending on how much of thestrings match.

For example, a standard comparison of the strings "xyzabc" and"abcxyz" would immediately see that the first character is differentand wouldn't bother to check the rest of the string. On the otherhand, when the strings "aaaaaaaaaaB" and "aaaaaaaaaaZ" are compared,the comparison algorithm scans through the block of "a" before itdetermins the strings are unequal.

It might seem like it would be impossible to run a timing attack overa network. However, it has been done, and has been shown to bepractical.

Here you can see the article

那检测到用户不存在怎么办？我绝对应该执行更多计算，但这里有什么好的技术？你们在这种情况下使用什么？

如果这有任何意义，我正在使用 C#。

Answer 1

解决方案很简单，无论用户是否存在，您都遵循相同的代码路径。

public static bool TryLogin(string email, string password)
{
    bool userExists = UserExists(email);

    var hash = GetRealPasswordHash(email);
    var hash2 = GetHash(email, password);
    return SlowEquals(hash, hash2) && userExists;
}

现在您需要确保 GetRealPasswordHash 对有效电子邮件和无效电子邮件花费相同的时间，并为无效电子邮件返回“假”哈希(“虚拟”用户的密码哈希 Guvante 指的是 in his comment )。

这可确保 GetHash 和 SlowEquals 仍会使用有效数据调用，但由于 userExists 为假，您将忽略它们的结果。

但是我也同意 Guvante 的第二点，任何正常的系统都会在多次尝试输入无效密码后锁定用户帐户。这可以防止针对用户登录的暴力/字典攻击。您只能在一段时间后或用户打电话来验证其身份后才能解锁登录。