Timing Attacks

2023-01-1805:28:56

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

github

easy-scrypt

timing attacks

verifypassphrase

scrypt.go

vulnerable

EPSS

0.002

Percentile

65.2%

JSON

github.com/agnivade/easy-scrypt is vulnerable to Timing Attacks. The vulnerability exists because the VerifyPassphrase function of scrypt.go does not compare hashes in constant time, allowing an attacker to progressively use the timing of the request to identify a valid hash.