Das deutsche Python-Forum

Code: Alles auswählen

def verify_password(password):
    return password == 'secret'

Code: Alles auswählen

~ $ virtualenv django_env
~ $ cd django_env/
~/django_env $ source bin/activate
(django_env)~/django_env $ pip install django
(django_env)~/django_env $ mkdir src
(django_env)~/django_env $ cd src
(django_env)~/django_env/src $ django-admin startproject timing-attack
(django_env)~/django_env/src $ cd timingattack/timingattack/
(django_env)~/django_env/src/timingattack/timingattack $ touch tests.py # <<<-- https://gist.github.com/jedie/ac7a0be713fb9d41a1d2
(django_env)~/django_env/src/timingattack/timingattack $ cd ..
(django_env)~/django_env/src/timingattack $ ./manage.py test
Creating test database for alias 'default'...

Measuring successful django login (200 loops)...
    Min/max avg with 30 items.
    avg.min: 45.7ms (-6%) - average: 48.8ms - avg.max: 54.5ms (10%) (takes 10.11 sec.)
Measuring 'wrong password' django login (200 loops)...
    Min/max avg with 30 items.
    avg.min: 49.0ms (-6%) - average: 52.1ms - avg.max: 57.0ms (8%) (takes 10.52 sec.)
Measuring 'wrong username' django login (200 loops)...
    Min/max avg with 30 items.
    avg.min: 48.5ms (-6%) - average: 51.6ms - avg.max: 58.0ms (11%) (takes 10.42 sec.)
 *** max.average django diff: 3.33ms (6.4%)
.
----------------------------------------------------------------------
Ran 1 test in 31.100s

Code: Alles auswählen

from __future__ import absolute_import, division, print_function


import time
import collections
import random


DEQUE_LENGTH = 50

class TimingAttackPreventer(object):
    succsessful_timings = collections.deque(maxlen=DEQUE_LENGTH)
    failed_timings = collections.deque(maxlen=DEQUE_LENGTH)

    def avg(self, deque):
        if deque:
            return sum(deque) / len(deque)
        else:
            return 0

    def __call__(self, func):
        def wrapped_func(*args, **kwargs):
            # log.debug("\ncall view %r with args: %r kwargs: %r",
            #     func.__name__, args, kwargs
            # )
            start_time=time.time()
            response = func(*args, **kwargs)

            succsessful_length = self.avg(self.succsessful_timings)
            failed_length = self.avg(self.failed_timings)

            diff_compensation = succsessful_length - failed_length
            no_compensation = 0

            if getattr(response, "add_duration", False):
                # successful request -> collect duration value
                timing_deque = self.succsessful_timings
                sleep_length = no_compensation
            else:
                # failed request -> 'fill' time with collect durations
                timing_deque = self.failed_timings
                sleep_length = diff_compensation

            if sleep_length<0:
                sleep_length=0

            timing_deque.append(time.time()-start_time)

            time.sleep(sleep_length)

            # log.debug("Response: %s", response)
            return response
        return wrapped_func


class NoAddDurationResponseMock(object):
    add_duration=False

class AddDurationResponseMock(object):
    add_duration=True


@TimingAttackPreventer()
def test(t, add_duration):
    time.sleep(t)
    if add_duration:
        return AddDurationResponseMock
    else:
        return NoAddDurationResponseMock


##############################################################################


count=200000

start_time = time.time()
for _ in range(count):
    test(t=0, add_duration=True)
duration1 = time.time()-start_time

start_time = time.time()
for _ in range(count):
    test(t=0, add_duration=False)
duration2 = time.time()-start_time

print("\n%f vs %f" % (duration1, duration2))
print("succsessful_timings", list(TimingAttackPreventer.succsessful_timings)[-3:])
print("failed_timings.....", list(TimingAttackPreventer.failed_timings)[-3:])


##############################################################################


count=500

start_time = time.time()
for _ in range(count):
    test(t=0.002, add_duration=True)
duration1 = time.time()-start_time


start_time = time.time()
for _ in range(count):
    test(t=0.001, add_duration=False)
duration2 = time.time()-start_time

print("\n%f vs %f" % (duration1, duration2))
print("succsessful_timings", list(TimingAttackPreventer.succsessful_timings)[-3:])
print("failed_timings.....", list(TimingAttackPreventer.failed_timings)[-3:])

Code: Alles auswählen

0.488604 vs 0.581449
succsessful_timings [0.0, 0.0, 0.0]
failed_timings..... [0.0, 0.0, 0.0]

1.322487 vs 1.062003
succsessful_timings [0.0029649734497070312, 0.0029020309448242188, 0.0029370784759521484]
failed_timings..... [0.0019538402557373047, 0.0019919872283935547, 0.0010120868682861328]