Simon Willison’s Weblog

Timing attack in Google Keyczar library. An issue I also need to fix in the proposed Django signing code. If you’re comparing two strings in crypto (e.g. seeing if the provided signature matches the expected signature) you need to use a timing independent string comparison function or you risk leaking information. This kind of thing is exactly why I want an audited signing module in Django rather than leaving developers to figure it out on their own.

# 4th January 2010, 3:23 pm / cryptography, django, keyczar, python, security, signing, timing-attack

Keyczar (via) New open source cryptography toolkit from Google, designed to get algorithm selection, key rotation and versioning right so you don’t have to. Java and Python versions are available; the Python version depends on PyCrypto.

# 13th August 2008, 1:20 pm / ben-laurie, encryption, google, java, keyczar, keyrotation, pycrypto, python