Security: timing side-channel in email/password authentication (secret comparison)

Summary

The email/password authentication in edb/server/protocol/auth_ext/email_password.py uses Python's == operator to compare password-derived secrets, which is vulnerable to timing side-channel attacks.

Location

edb/server/protocol/auth_ext/email_password.py, line 199:

return local_identity if secret == current_secret else None

Where current_secret is a base64-encoded SHA-256 hash of the stored password hash (line 195-197).

Impact

High — Python's == on strings short-circuits on the first differing character. An attacker can measure response latency to determine how many leading characters of their guess match the stored hash, enabling character-by-character reconstruction.

This is particularly concerning because:

• This is an authentication path — it's called on every login attempt
• The compared values are deterministic (SHA-256 hashes) — no nonce or randomness to mitigate
• Network timing attacks on auth endpoints are well-documented and practical

Fix

Replace with hmac.compare_digest (stdlib, constant-time):

import hmac

return local_identity if hmac.compare_digest(secret, current_secret) else None

No additional dependencies needed — hmac.compare_digest is in Python's standard library.

References

• CWE-208: Observable Timing Discrepancy
• Python docs: hmac.compare_digest
• Identified during a security audit