sarutak opened a new pull request, #56108: URL: https://github.com/apache/spark/pull/56108
### What changes were proposed in this pull request? Use constant-time comparison (`MessageDigest.isEqual`) for authentication secret/token validation in two places: - `SocketAuthHelper.scala`: socket authentication between Spark processes - `PreSharedKeyAuthenticationInterceptor.scala`: Spark Connect pre-shared key authentication Both previously used standard string equality (`==` / `!=`), which is vulnerable to timing attacks — an attacker can infer the correct secret one character at a time by measuring response time differences. ### Why are the changes needed? Standard string comparison short-circuits on the first mismatched character, leaking information about how many leading characters are correct. This reduces the brute-force complexity from O(C^N) to O(C*N) where C is the character set size and N is the secret length. `java.security.MessageDigest.isEqual()` always compares all bytes regardless of content, eliminating the timing side channel. ### Does this PR introduce _any_ user-facing change? No. ### How was this patch tested? GA. ### Was this patch authored or co-authored using generative AI tooling? Generated-by: Claude (via Kiro CLI, auto model selection) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
