* Compare the password entered by a client with the actual password. * The comparision is safe against timing attacks. */
| 1970 | * The comparision is safe against timing attacks. |
| 1971 | */ |
| 1972 | bool Utility::ComparePasswords(const String& enteredPassword, const String& actualPassword) |
| 1973 | { |
| 1974 | volatile const char * volatile enteredPasswordCStr = enteredPassword.CStr(); |
| 1975 | volatile size_t enteredPasswordLen = enteredPassword.GetLength(); |
| 1976 | |
| 1977 | volatile const char * volatile actualPasswordCStr = actualPassword.CStr(); |
| 1978 | volatile size_t actualPasswordLen = actualPassword.GetLength(); |
| 1979 | |
| 1980 | volatile uint_fast8_t result = enteredPasswordLen == actualPasswordLen; |
| 1981 | |
| 1982 | if (result) { |
| 1983 | auto cStr (actualPasswordCStr); |
| 1984 | auto len (actualPasswordLen); |
| 1985 | |
| 1986 | actualPasswordCStr = cStr; |
| 1987 | actualPasswordLen = len; |
| 1988 | } else { |
| 1989 | auto cStr (enteredPasswordCStr); |
| 1990 | auto len (enteredPasswordLen); |
| 1991 | |
| 1992 | actualPasswordCStr = cStr; |
| 1993 | actualPasswordLen = len; |
| 1994 | } |
| 1995 | |
| 1996 | for (volatile size_t i = 0; i < enteredPasswordLen; ++i) { |
| 1997 | result &= uint_fast8_t(enteredPasswordCStr[i] == actualPasswordCStr[i]); |
| 1998 | } |
| 1999 | |
| 2000 | return result; |
| 2001 | } |
| 2002 | |
| 2003 | /** |
| 2004 | * Normalizes the given struct tm like mktime() from libc does with some exception for DST handling: If the given time |