Simon Willison’s Weblog

Don’t Hash Secrets. A well written explanation from 2008 of why you must use hmac instead of raw SHA-1 when hashing against a secret.

# 24th January 2010, 1:30 pm / cryptography, hmac, security, sha1, signing

Timing attack in Google Keyczar library. An issue I also need to fix in the proposed Django signing code. If you’re comparing two strings in crypto (e.g. seeing if the provided signature matches the expected signature) you need to use a timing independent string comparison function or you risk leaking information. This kind of thing is exactly why I want an audited signing module in Django rather than leaving developers to figure it out on their own.

# 4th January 2010, 3:23 pm / cryptography, django, keyczar, python, security, signing, timing-attack