{"action":"created","issue":{"url":"https://api.github.com/repos/jedisct1/libsodium/issues/276","labels_url":"https://api.github.com/repos/jedisct1/libsodium/issues/276/labels{/name}","comments_url":"https://api.github.com/repos/jedisct1/libsodium/issues/276/comments","events_url":"https://api.github.com/repos/jedisct1/libsodium/issues/276/events","html_url":"https://github.com/jedisct1/libsodium/issues/276","id":90779142,"number":276,"title":"sodium_hex2bin isn't fully constant time","user":{"login":"marksteward","id":121960,"avatar_url":"https://avatars.githubusercontent.com/u/121960?v=3","gravatar_id":"","url":"https://api.github.com/users/marksteward","html_url":"https://github.com/marksteward","followers_url":"https://api.github.com/users/marksteward/followers","following_url":"https://api.github.com/users/marksteward/following{/other_user}","gists_url":"https://api.github.com/users/marksteward/gists{/gist_id}","starred_url":"https://api.github.com/users/marksteward/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/marksteward/subscriptions","organizations_url":"https://api.github.com/users/marksteward/orgs","repos_url":"https://api.github.com/users/marksteward/repos","events_url":"https://api.github.com/users/marksteward/events{/privacy}","received_events_url":"https://api.github.com/users/marksteward/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2015-06-24T21:00:28Z","updated_at":"2015-06-24T22:05:14Z","closed_at":"2015-06-24T21:58:30Z","body":"See also #241.\r\n\r\nI was pointed to sodium_hex2bin in a discussion and noticed that, unlike sodium_bin2hex, it's half constant time and half not. If the input data contains invalid or ignored characters, the function is not constant time, in a way that depends on the data passed in.\r\n\r\nThere are three ways to improve this:\r\n - switch to a constant-time strchr\r\n - filter out characters that are >= 0x80\r\n - move the validation to a separate initial loop, which tracks a `valid` variable\r\n - accept an ignore_count parameter which ensures that strchr is only called a fixed number of times\r\n - hope that we don't hit any caching issues on the `ignore` memory\r\n\r\nor:\r\n - move all the `ignore` functionality to a separate function which strips out characters and leave it to the user to ensure this is called safely\r\n - track a \"valid\" variable and only throw an error at the end of the loop\r\n - comment that the function requires all characters to be < 0x80\r\n\r\nor:\r\n - comment that the function is not constant time when non-hex data is passed in\r\n - update the documentation to say the same\r\n\r\nI'm happy to do any of these, but I don't know much about the project, so I'm not sure which is most suitable. My preference would be the second option, because it's a lot easier to reason about constant-time functions when they don't have branches, and most of the branches come from the `ignore` functionality."},"comment":{"url":"https://api.github.com/repos/jedisct1/libsodium/issues/comments/115024778","html_url":"https://github.com/jedisct1/libsodium/issues/276#issuecomment-115024778","issue_url":"https://api.github.com/repos/jedisct1/libsodium/issues/276","id":115024778,"user":{"login":"marksteward","id":121960,"avatar_url":"https://avatars.githubusercontent.com/u/121960?v=3","gravatar_id":"","url":"https://api.github.com/users/marksteward","html_url":"https://github.com/marksteward","followers_url":"https://api.github.com/users/marksteward/followers","following_url":"https://api.github.com/users/marksteward/following{/other_user}","gists_url":"https://api.github.com/users/marksteward/gists{/gist_id}","starred_url":"https://api.github.com/users/marksteward/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/marksteward/subscriptions","organizations_url":"https://api.github.com/users/marksteward/orgs","repos_url":"https://api.github.com/users/marksteward/repos","events_url":"https://api.github.com/users/marksteward/events{/privacy}","received_events_url":"https://api.github.com/users/marksteward/received_events","type":"User","site_admin":false},"created_at":"2015-06-24T22:05:14Z","updated_at":"2015-06-24T22:05:14Z","body":"Is it not worth saying this in the documentation?"}}