use constant-time comparison for HMAC in cupsJWTHasValidSignature

[aizu-m]

Was reading through the JOSE signature paths in jwt.c. The HMAC branch stood out:

// cups/jwt.c, cupsJWTHasValidSignature(), HS256/HS384/HS512
ret = jwt->sigsize == sigsize && !memcmp(jwt->signature, signature, sigsize);

signature here is the HMAC recomputed from the shared secret; jwt->signature is the value off the wire. memcmp returns at the first differing byte, so the compare time tracks how many leading bytes of the supplied tag are correct. That is a byte-at-a-time timing oracle: an attacker can recover a valid HMAC one byte at a time without ever knowing the key.

cupsJWTHasValidSignature is a public API and gets called on OIDC id_tokens from oauth.c, so both the token and its signature are attacker-controlled. The RS/ES branches verify through RSA_verify / ECDSA_do_verify (public key, no secret) so they are fine as they stand. Only the symmetric branch compares a secret-derived value, so only it needs a constant-time compare.

Swapped memcmp for CRYPTO_memcmp on OpenSSL and gnutls_memcmp on GnuTLS. Result is identical for valid and invalid tokens; testjwt passes on both backends.

[michaelrsweet]

Please sign your commits...

WRT the changes, while I understand the concern here, given the number of variables in such an attack, the (small) size of the signatures being compared, and the introspection that is typically used for OAuth access tokens, it is highly unlikely that this is more than a theoretical issue.

That said, your changes are small and take advantage of existing APIs in GNU TLS and OpenSSL so I have no problem incorporating them here and in libcups.

[michaelrsweet]

CUPS 2.5:

[master 9d7134d5c] Use constant-time memcmp for HMACs (Issue #1680)

libcups 3.0:

[master 2b2786a67] Use constant-time memcmp for HMACs.