ELY-2430: Update AbstractX509CertificateChainCredential to make use o…

…f MessageDigest#isEqual to avoid a potential timing attack
wildfly-security · Oct 18, 2022 · 1e386fd · 1e386fd
1 parent 4abb472
commit 1e386fd
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/...src/main/java/org/wildfly/security/credential/AbstractX509CertificateChainCredential.java b/...src/main/java/org/wildfly/security/credential/AbstractX509CertificateChainCredential.java
@@ -21,8 +21,8 @@
 import java.security.Provider;
 import java.security.cert.CertificateEncodingException;
 import java.security.cert.X509Certificate;
+import java.security.MessageDigest;
 import java.security.spec.AlgorithmParameterSpec;
-import java.util.Arrays;
 import java.util.function.Supplier;
 
 import org.wildfly.common.Assert;
@@ -56,7 +56,7 @@ public boolean verify(final Evidence evidence) {
         if (evidence instanceof X509PeerCertificateChainEvidence) {
             final X509PeerCertificateChainEvidence peerCertificateChainEvidence = (X509PeerCertificateChainEvidence) evidence;
             try {
-                return getAlgorithm().equals(peerCertificateChainEvidence.getAlgorithm()) && Arrays.equals(getFirstCertificate().getEncoded(), peerCertificateChainEvidence.getFirstCertificate().getEncoded());
+                return getAlgorithm().equals(peerCertificateChainEvidence.getAlgorithm()) && MessageDigest.isEqual(getFirstCertificate().getEncoded(), peerCertificateChainEvidence.getFirstCertificate().getEncoded());
             } catch (CertificateEncodingException e) {
             }
         }