fix(tokens): Hash tokens in tokens module to resist ND2DB-style timing attack

[Blckbrry-Pi]

Resolves OGB-53

[Blckbrry-Pi]

• fix(tokens): Hash tokens in tokens module to resist ND2DB-style timing attack #83 👈
• chore: migrate from yaml to json #103 : 1 other dependent PR (#104 )
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.

Join @Blckbrry-Pi and the rest of your teammates on Graphite

[linear]

OGB-53 Combination of B-Tree index + unhashed tokens may leave `tokens` vulnerable to a ND2DB-adjacent timing attack.

[MasterPtato]

I'm not too familiar with this kind if attack, is it possible to write a unit test that confirms this attack is no longer valid after this patch?

[Blckbrry-Pi]

I'm not too familiar with this kind if attack, is it possible to write a unit test that confirms this attack is no longer valid after this patch?

Almost definitely not.
The theoretical timing attack I proposed would probably take about 3 days minimum to attempt, and that would be if the attacker was on the lucky side.

I can almost guarantee that this style of timing attack will be impossible until a method is released to manipulate SHA256 hashes bit by bit.

[NathanFlurry]

remove

[NathanFlurry]

this is more lines of code and harder to understand than just manually passing in each parameter from the row in to the response.