Equalize crypt() cost when password auth is rejected early by stenslae · Pull Request #1116 · wolfSSL/wolfssh

stenslae · 2026-07-21T22:50:52Z

DoFakePasswordCheck() runs a cost-matched dummy crypt() on the RequestAuthentication() paths that reject before the real check.
CheckPasswordHashUnix() no longer short-circuits on a locked or empty stored hash.
wolfSSHD_AuthInit() caches up to 8 salt-only templates from /etc/shadow at startup, before the privilege drop.
CheckPasswordUnix() fails closed on NULL sp_pwdp and over-long hashes.
25 new test_configuration cases; it moves to check_PROGRAMS so CI runs it.
Measured on $6$ : gap drops from +258 ms to -6 ms. Not covered: yescrypt (~+673 ms, unchanged), PAM, and DefaultUserAuthTypes() advertising no methods for unknown users.

wolfSSL-Fenrir-bot

Fenrir Automated Review — PR #1116

Scan targets checked: wolfssh-bugs, wolfssh-src

Findings: 1
1 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Findings are non-blocking.

wolfSSL-Fenrir-bot

Fenrir Automated Review — PR #1116

Scan targets checked: wolfssh-bugs, wolfssh-src

Findings: 1
1 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Findings are non-blocking.

wolfSSL-Fenrir-bot

Fenrir Automated Review — PR #1116

Scan targets checked: wolfssh-bugs, wolfssh-src

Findings: 1
1 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Findings are non-blocking.

wolfSSL-Fenrir-bot

Fenrir Automated Review — PR #1116

Scan targets checked: wolfssh-bugs, wolfssh-src

No new issues found in the changed files. ✅

wolfSSL-Fenrir-bot

Fenrir Automated Review — PR #1116

Scan targets checked: wolfssh-bugs, wolfssh-src

No new issues found in the changed files. ✅

wolfSSL-Fenrir-bot

Fenrir Automated Review — PR #1116

Scan targets checked: wolfssh-bugs, wolfssh-src

Findings: 1
1 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Findings are non-blocking.

wolfSSL-Fenrir-bot

Fenrir Automated Review — PR #1116

Scan targets checked: wolfssh-bugs, wolfssh-src

Findings: 1
1 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Findings are non-blocking.

wolfSSL-Fenrir-bot

Fenrir Automated Review — PR #1116

Scan targets checked: wolfssh-bugs, wolfssh-src

Findings: 3
3 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Findings are non-blocking.

wolfSSL-Fenrir-bot

Fenrir Automated Review — PR #1116

Scan targets checked: wolfssh-bugs, wolfssh-src

No new issues found in the changed files. ✅

wolfSSL-Fenrir-bot

Fenrir Automated Review — PR #1116

Scan targets checked: wolfssh-bugs, wolfssh-src

Findings: 3
3 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Findings are non-blocking.

wolfSSL-Fenrir-bot

Fenrir Automated Review — PR #1116

Scan targets checked: wolfssh-bugs, wolfssh-src

Findings: 1
1 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Findings are non-blocking.

stenslae requested a review from wolfSSL-Fenrir-bot July 21, 2026 22:50

stenslae self-assigned this Jul 21, 2026

wolfSSL-Fenrir-bot reviewed Jul 21, 2026

View reviewed changes

Comment thread apps/wolfsshd/auth.h Outdated

stenslae commented Jul 22, 2026

View reviewed changes

Comment thread apps/wolfsshd/auth.h Outdated

stenslae force-pushed the pr-timing-oracle branch from 6be2e53 to 49470f2 Compare July 23, 2026 16:07

stenslae requested a review from wolfSSL-Fenrir-bot July 23, 2026 16:10

wolfSSL-Fenrir-bot reviewed Jul 23, 2026

View reviewed changes

Comment thread apps/wolfsshd/auth.c

stenslae commented Jul 23, 2026

View reviewed changes

Comment thread apps/wolfsshd/auth.c

stenslae force-pushed the pr-timing-oracle branch from 49470f2 to f1ec2b3 Compare July 23, 2026 17:11

stenslae requested review from wolfSSL-Fenrir-bot and removed request for wolfSSL-Fenrir-bot July 23, 2026 17:11

wolfSSL-Fenrir-bot reviewed Jul 23, 2026

View reviewed changes

Comment thread apps/wolfsshd/auth.c

stenslae commented Jul 27, 2026

View reviewed changes

Comment thread apps/wolfsshd/auth.c

stenslae force-pushed the pr-timing-oracle branch from f1ec2b3 to 4c429fa Compare July 27, 2026 16:33

stenslae requested a review from wolfSSL-Fenrir-bot July 27, 2026 16:33

wolfSSL-Fenrir-bot reviewed Jul 27, 2026

View reviewed changes

stenslae assigned wolfSSL-Bot and unassigned stenslae Jul 27, 2026

stenslae force-pushed the pr-timing-oracle branch from 4c429fa to 101b87a Compare July 29, 2026 21:03

stenslae requested a review from wolfSSL-Fenrir-bot July 29, 2026 21:05

wolfSSL-Fenrir-bot reviewed Jul 29, 2026

View reviewed changes

stenslae force-pushed the pr-timing-oracle branch from 101b87a to be56e50 Compare July 31, 2026 21:29

stenslae requested a review from wolfSSL-Fenrir-bot July 31, 2026 21:29

wolfSSL-Fenrir-bot reviewed Jul 31, 2026

View reviewed changes

Comment thread apps/wolfsshd/auth.h Outdated

stenslae commented Jul 31, 2026

View reviewed changes

Comment thread apps/wolfsshd/auth.h Outdated

stenslae force-pushed the pr-timing-oracle branch from be56e50 to 568fea0 Compare July 31, 2026 21:55

stenslae requested a review from wolfSSL-Fenrir-bot July 31, 2026 21:55

stenslae commented Jul 31, 2026

View reviewed changes

Comment thread apps/wolfsshd/auth.c Outdated

stenslae force-pushed the pr-timing-oracle branch from 568fea0 to b1ea836 Compare July 31, 2026 22:52

stenslae requested a review from wolfSSL-Fenrir-bot July 31, 2026 22:52

stenslae force-pushed the pr-timing-oracle branch from b1ea836 to dc37d33 Compare July 31, 2026 22:59

wolfSSL-Fenrir-bot reviewed Jul 31, 2026

View reviewed changes

Comment thread apps/wolfsshd/auth.c Outdated

stenslae commented Aug 3, 2026

View reviewed changes

Comment thread apps/wolfsshd/auth.c Outdated

stenslae force-pushed the pr-timing-oracle branch from dc37d33 to 5732e90 Compare August 3, 2026 16:08

stenslae requested a review from wolfSSL-Fenrir-bot August 3, 2026 16:08

stenslae force-pushed the pr-timing-oracle branch from 5732e90 to 2dd784c Compare August 3, 2026 16:22

wolfSSL-Fenrir-bot reviewed Aug 3, 2026

View reviewed changes

Comment thread apps/wolfsshd/auth.c Outdated

Comment thread apps/wolfsshd/test/test_configuration.c

Comment thread apps/wolfsshd/test/test_configuration.c

stenslae force-pushed the pr-timing-oracle branch from 2dd784c to da0f70b Compare August 3, 2026 16:32

stenslae commented Aug 3, 2026

View reviewed changes

Comment thread apps/wolfsshd/test/test_configuration.c

stenslae commented Aug 3, 2026

View reviewed changes

Comment thread apps/wolfsshd/test/test_configuration.c

stenslae commented Aug 3, 2026

View reviewed changes

Comment thread apps/wolfsshd/auth.c Outdated

stenslae requested a review from wolfSSL-Fenrir-bot August 3, 2026 16:35

wolfSSL-Fenrir-bot reviewed Aug 3, 2026

View reviewed changes

stenslae assigned ejohnstown Aug 3, 2026

stenslae force-pushed the pr-timing-oracle branch from da0f70b to 1b6b43a Compare August 3, 2026 21:29

stenslae requested a review from wolfSSL-Fenrir-bot August 3, 2026 21:29

wolfSSL-Fenrir-bot reviewed Aug 3, 2026

View reviewed changes

Comment thread apps/wolfsshd/test/test_configuration.c Outdated

Comment thread apps/wolfsshd/test/test_configuration.c Outdated

Comment thread apps/wolfsshd/auth.c Outdated

stenslae commented Aug 4, 2026

View reviewed changes

Comment thread apps/wolfsshd/auth.c Outdated

stenslae commented Aug 4, 2026

View reviewed changes

Comment thread apps/wolfsshd/test/test_configuration.c Outdated

stenslae commented Aug 4, 2026

View reviewed changes

Comment thread apps/wolfsshd/test/test_configuration.c Outdated

Mitigate user enumeration timing oracle using dummy hash cache

eca6900

stenslae force-pushed the pr-timing-oracle branch from 1b6b43a to eca6900 Compare August 4, 2026 15:53

stenslae requested a review from wolfSSL-Fenrir-bot August 4, 2026 15:53

wolfSSL-Fenrir-bot reviewed Aug 4, 2026

View reviewed changes

Comment thread apps/wolfsshd/auth.c

ejohnstown changed the title ~~Mitigate timing oracle using dummy hash cache~~ Equalize crypt() cost when password auth is rejected early Aug 5, 2026

ejohnstown approved these changes Aug 5, 2026

View reviewed changes

ejohnstown merged commit 492e8cd into wolfSSL:master Aug 5, 2026
154 checks passed

Uh oh!

Conversation

stenslae commented Jul 21, 2026 • edited by ejohnstown Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

wolfSSL-Fenrir-bot left a comment

Choose a reason for hiding this comment

Fenrir Automated Review — PR #1116

Uh oh!

Uh oh!

Uh oh!

wolfSSL-Fenrir-bot left a comment

Choose a reason for hiding this comment

Fenrir Automated Review — PR #1116

Uh oh!

Uh oh!

Uh oh!

wolfSSL-Fenrir-bot left a comment

Choose a reason for hiding this comment

Fenrir Automated Review — PR #1116

Uh oh!

Uh oh!

Uh oh!

wolfSSL-Fenrir-bot left a comment

Choose a reason for hiding this comment

Fenrir Automated Review — PR #1116

Uh oh!

wolfSSL-Fenrir-bot left a comment

Choose a reason for hiding this comment

Fenrir Automated Review — PR #1116

Uh oh!

wolfSSL-Fenrir-bot left a comment

Choose a reason for hiding this comment

Fenrir Automated Review — PR #1116

Uh oh!

Uh oh!

Uh oh!

Uh oh!

wolfSSL-Fenrir-bot left a comment

Choose a reason for hiding this comment

Fenrir Automated Review — PR #1116

Uh oh!

Uh oh!

Uh oh!

wolfSSL-Fenrir-bot left a comment

Choose a reason for hiding this comment

Fenrir Automated Review — PR #1116

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

wolfSSL-Fenrir-bot left a comment

Choose a reason for hiding this comment

Fenrir Automated Review — PR #1116

Uh oh!

wolfSSL-Fenrir-bot left a comment

Choose a reason for hiding this comment

Fenrir Automated Review — PR #1116

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

wolfSSL-Fenrir-bot left a comment

Choose a reason for hiding this comment

Fenrir Automated Review — PR #1116

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

stenslae commented Jul 21, 2026 •

edited by ejohnstown

Loading