CSHARP-1389: use a constant time comparison function for ScramSha1 signature comparisons.

Author: craiggwilson

src/MongoDB.Driver.Core/Core/Authentication/ScramSha1Authenticator.cs

@@ -177,7 +177,7 @@ public ISaslStep Transition(SaslConversation conversation, byte[] bytesReceivedF
                 var proof = "p=" + Convert.ToBase64String(clientProof);
                 var clientFinalMessage = clientFinalMessageWithoutProof + "," + proof;
 
-                return new ClientLast(encoding.GetBytes(clientFinalMessage), Convert.ToBase64String(serverSignature));
+                return new ClientLast(encoding.GetBytes(clientFinalMessage), serverSignature);
             }
 
             private static byte[] XOR(byte[] a, byte[] b)
@@ -219,9 +219,9 @@ private static byte[] HMAC(UTF8Encoding encoding, byte[] data, string key)
         private class ClientLast : ISaslStep
         {
             private readonly byte[] _bytesToSendToServer;
-            private readonly string _serverSignature64;
+            private readonly byte[] _serverSignature64;
 
-            public ClientLast(byte[] bytesToSendToServer, string serverSignature64)
+            public ClientLast(byte[] bytesToSendToServer, byte[] serverSignature64)
             {
                 _bytesToSendToServer = bytesToSendToServer;
                 _serverSignature64 = serverSignature64;
@@ -241,16 +241,26 @@ public ISaslStep Transition(SaslConversation conversation, byte[] bytesReceivedF
             {
                 var encoding = Utf8Encodings.Strict;
                 var map = NVParser.Parse(encoding.GetString(bytesReceivedFromServer));
+                var serverSignature = Convert.FromBase64String(map['v']);
 
-                var serverSignature = map['v'];
-
-                if (_serverSignature64 != serverSignature)
+                if (!ConstantTimeEquals(_serverSignature64, serverSignature))
                 {
                     throw new MongoAuthenticationException(conversation.ConnectionId, message: "Server signature was invalid.");
                 }
 
                 return new CompletedStep();
             }
+
+            private bool ConstantTimeEquals(byte[] a, byte[] b)
+            {
+                var diff = a.Length ^ b.Length;
+                for (var i = 0; i < a.Length && i < b.Length; i++)
+                {
+                    diff |= a[i] ^ b[i];
+                }
+
+                return diff == 0;
+            }
         }
 
         private class NVParser