Verify master key signatures in constant time

fmeum · Dec 7, 2019 · 532c6ad · 532c6ad
1 parent 63fc65d
commit 532c6ad
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/authenticator/src/main/java/me/henneke/wearauthn/fido/context/Keystore.kt b/authenticator/src/main/java/me/henneke/wearauthn/fido/context/Keystore.kt
@@ -317,7 +317,7 @@ fun pokeMasterSigningKey() {
 }
 
 private fun verifyWithMasterSigningKey(signature: ByteArray, vararg data: ByteArray): Boolean {
-    return signWithMasterSigningKey(*data).contentEquals(signature)
+    return MessageDigest.isEqual(signWithMasterSigningKey(*data), signature)
 }
 
 data class Assertion(val authenticatorData: ByteArray, val signature: ByteArray) {