[HN Gopher] A Base64 Surprise
       ___________________________________________________________________
        
       A Base64 Surprise
        
       Author : todsacerdoti
       Score  : 30 points
       Date   : 2022-01-29 16:27 UTC (6 hours ago)
        
 (HTM) web link (cendyne.dev)
 (TXT) w3m dump (cendyne.dev)
        
       | loyalcinnamon wrote:
       | The little grapthics explaining stuff is really cute!
       | 
       | Other than that, cool article :)
        
         | cendyne wrote:
         | Hey thanks!
        
       | jedisct1 wrote:
       | The choice to ignore or reject non-null trailing padding bits is
       | really implementation dependent.
       | 
       | Python and Zig reject invalid padding.
       | 
       | PHP's base64_decode() function accepts it, but the
       | sodium_base642bin() function doesn't.
       | 
       | Since Rust doesn't have base64 support, it depends on the crate
       | being used. The ct-codecs crate rejects invalid padding, the
       | base64 crate doesn't.
       | 
       | So... it depends.
       | 
       | But that issue is well known, and I think most modern
       | implementations reject invalid padding. And in the context of
       | cryptographic operations, you are supposed to use codecs from the
       | cryptographic libraries you are using anyway. These
       | implementations avoid side channels, and, of course, reject non-
       | canonical encodings.
        
         | cendyne wrote:
         | Your example [1] on twitter for PHP is actually quite telling.
         | 
         | I do not think it is well known among application developers,
         | which is why I wrote this post. In fact, my base64
         | implementation elsewhere is vulnerable to this and it never
         | occurred to me.
         | 
         | Thank you for the rust library recommendation, I was using
         | base64ct.
         | 
         | [1]: https://archive.is/RZwlH
        
       ___________________________________________________________________
       (page generated 2022-01-29 23:01 UTC)