I saw a Twitter discussion with Colin a couple weeks ago here he pointed out that Python no longer guarantees constant time for all of the basic binary operations like addition (since fixed width integers can spill over to arbitrary precision math if you overflow them, or breathe on them wrong).
Password hashing function almost by definition does not handle any data that must be protected from the user, so side channel leaks do not make much sense. Only secret information comes into play in final comparison of hash of user supplied password and your stored hash and I don't see any way of exploiting possible timing leak in that comparison that does not require breaking the hash in the first place.
Comments
There's a pure-Python implementation of PBKDF2. I know it's not as good as bcrypt or scrypt, but at least it's better than MD5 or one of the SHA's.
I saw a Twitter discussion with Colin a couple weeks ago here he pointed out that Python no longer guarantees constant time for all of the basic binary operations like addition (since fixed width integers can spill over to arbitrary precision math if you overflow them, or breathe on them wrong).
Be careful.
Password hashing function almost by definition does not handle any data that must be protected from the user, so side channel leaks do not make much sense. Only secret information comes into play in final comparison of hash of user supplied password and your stored hash and I don't see any way of exploiting possible timing leak in that comparison that does not require breaking the hash in the first place.
Side channels don't matter for bcrypt.
Can you explain why this is? (Not doubting you; just curious.)
The online operations exposed to an attacker in a bcrypt system are done almost entirely on attacker-known data.
Oh boy. That could get messy.