C语言-比较字符串是否相等(计时攻击)

最新推荐文章于 2023-03-04 17:24:18 发布

tyustyu

最新推荐文章于 2023-03-04 17:24:18 发布

阅读量477

点赞数 1

分类专栏： C语言文章标签：字符串比较计时攻击

本文链接：https://blog.csdn.net/tyustli/article/details/111587619

版权

C语言同时被 2 个专栏收录

50 篇文章 20 订阅

订阅专栏

python

19 篇文章 0 订阅

订阅专栏

C 语言版

#include <stdio.h>

int util_cmp_const(const void *a, const void *b, const size_t size)
{
    const unsigned char *_a = (const unsigned char *)a;
    const unsigned char *_b = (const unsigned char *)b;
    unsigned char result = 0;
    size_t i;

    for (i = 0; i < size; i++)
    {
        result |= _a[i] ^ _b[i];
    }

    return result; /* returns 0 if equal, nonzero otherwise */
}

int main(int argc, char *argv[])
{
    char result = 0;
    printf("hello tyustli\r\n");

    result = util_cmp_const("abcdef", "abcdee", 6);
    printf("result = %d\n", result);

    result = util_cmp_const("abcdef", "abcdef", 6);
    printf("result = %d\n", result);

    return 1;
}

/*
 编译： gcc -o out timming_attack.c 
 运行: ./out
 结果：
 hello tyustli
 result = 3
 result = 0
*/

/******************** end of file ***********************/

python 版

def constant_time_compare(val1, val2):
    """
    Returns True if the two strings are equal, False otherwise.

    The time taken is independent of the number of characters that match.

    For the sake of simplicity, this function executes in constant time only
    when the two strings have the same length. It short-circuits when they
    have different lengths.
    """
    if len(val1) != len(val2):
        return False
    result = 0
    for x, y in zip(val1, val2):
        result |= ord(x) ^ ord(y)
    return result == 0

result = constant_time_compare("abcdef", "abcdee")
print(result)

result = constant_time_compare("abcdef", "abcdef")
print(result)

应用

计时攻击