{"action":"created","issue":{"url":"https://api.github.com/repos/tj/node-cookie-signature/issues/19","labels_url":"https://api.github.com/repos/tj/node-cookie-signature/issues/19/labels{/name}","comments_url":"https://api.github.com/repos/tj/node-cookie-signature/issues/19/comments","events_url":"https://api.github.com/repos/tj/node-cookie-signature/issues/19/events","html_url":"https://github.com/tj/node-cookie-signature/issues/19","id":64889776,"number":19,"title":"Why \"sha1(mac) == sha1(val)\" ?","user":{"login":"lyenliang","id":3468329,"avatar_url":"https://avatars.githubusercontent.com/u/3468329?v=3","gravatar_id":"","url":"https://api.github.com/users/lyenliang","html_url":"https://github.com/lyenliang","followers_url":"https://api.github.com/users/lyenliang/followers","following_url":"https://api.github.com/users/lyenliang/following{/other_user}","gists_url":"https://api.github.com/users/lyenliang/gists{/gist_id}","starred_url":"https://api.github.com/users/lyenliang/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/lyenliang/subscriptions","organizations_url":"https://api.github.com/users/lyenliang/orgs","repos_url":"https://api.github.com/users/lyenliang/repos","events_url":"https://api.github.com/users/lyenliang/events{/privacy}","received_events_url":"https://api.github.com/users/lyenliang/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2015-03-28T02:43:35Z","updated_at":"2015-03-28T15:42:43Z","closed_at":"2015-03-28T03:07:54Z","body":"I'd like to know why use \"sha1(mac) == sha1(val)\" instead of \"mac == val\" at line 42 in index.js.\r\nIs this some kind of security issue? It is necessary to use sha1 here?"},"comment":{"url":"https://api.github.com/repos/tj/node-cookie-signature/issues/comments/87249985","html_url":"https://github.com/tj/node-cookie-signature/issues/19#issuecomment-87249985","issue_url":"https://api.github.com/repos/tj/node-cookie-signature/issues/19","id":87249985,"user":{"login":"rlidwka","id":999113,"avatar_url":"https://avatars.githubusercontent.com/u/999113?v=3","gravatar_id":"","url":"https://api.github.com/users/rlidwka","html_url":"https://github.com/rlidwka","followers_url":"https://api.github.com/users/rlidwka/followers","following_url":"https://api.github.com/users/rlidwka/following{/other_user}","gists_url":"https://api.github.com/users/rlidwka/gists{/gist_id}","starred_url":"https://api.github.com/users/rlidwka/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rlidwka/subscriptions","organizations_url":"https://api.github.com/users/rlidwka/orgs","repos_url":"https://api.github.com/users/rlidwka/repos","events_url":"https://api.github.com/users/rlidwka/events{/privacy}","received_events_url":"https://api.github.com/users/rlidwka/received_events","type":"User","site_admin":false},"created_at":"2015-03-28T15:42:43Z","updated_at":"2015-03-28T15:42:43Z","body":"`mac == val` is prone to timing attacks. You can look for \"timing attacks\" in google/wiki/etc., there are plenty of information about it.\r\n\r\n`sha1(mac) == sha1(val)` is presumed to be immune to it, because sha1 function output effectively randomizes bits."}}