Bootstrap token comparison is not constant-time #72

New Issue

Skipper · 2026-04-05T16:23:11Z

Skipper commented

2026-04-05 16:23:11 +00:00

Info

Severity: HIGH
Attack vector: network-only

Impact

Allows an attacker on the same network segment to recover the bootstrap token and register a malicious user agent.

Description

The bootstrap token is compared using normal Rust String equality, which short-circuits on the first mismatching byte. That creates a timing side channel that leaks how much of the supplied token prefix matches the expected value.

Example flow

Send repeated bootstrap token guesses over gRPC.
Measure response timing differences caused by early-exit string comparison.
Recover the token incrementally, byte by byte.
Use the recovered token to register an attacker-controlled user agent before the legitimate operator does.

Mitigation

Replace the comparison with a constant-time equality function such as subtle::ConstantTimeEq.

# Info **Severity**: **HIGH** Attack vector: network-only ## Impact Allows an attacker on the same network segment to recover the bootstrap token and register a malicious user agent. ## Description The bootstrap token is compared using normal Rust `String` equality, which short-circuits on the first mismatching byte. That creates a timing side channel that leaks how much of the supplied token prefix matches the expected value. ## Example flow 1. Send repeated bootstrap token guesses over gRPC. 2. Measure response timing differences caused by early-exit string comparison. 3. Recover the token incrementally, byte by byte. 4. Use the recovered token to register an attacker-controlled user agent before the legitimate operator does. ## Mitigation Replace the comparison with a constant-time equality function such as `subtle::ConstantTimeEq`.

Skipper closed this issue

2026-04-06 16:34:01 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: MarketTakers/arbiter#72