hard20 pts · first answer countsembedded-securitycryptography

Comparing a message authentication code

The firmware checks a received HMAC with memcmp(received, expected, 32). Why is this a security problem?

A.memcmp cannot compare binary dataB.memcmp returns as soon as a byte differs, so timing leaks how many bytes matchedC.memcmp only compares 16 bytesD.HMACs must be compared as strings

Discussion 0

Join free to post in the discussion.

Comparing a message authentication code

Discussion 0

Related questions