Bleichenbacher Attack in Fiber with Hmac Signatures

A Bleichenbacher attack targets adaptive chosen-ciphertext in RSA-based padding schemes (e.g., PKCS#1 v1.5). In a Fiber application that uses Hmac Signatures to protect routing or API tokens, the risk arises when a server exposes behavior differences—such as timing or error messages—during signature verification. If an attacker can submit many candidate signatures and observe whether verification fails due to padding errors versus MAC failures, they can iteratively recover the plaintext or forge a valid signature. This is especially relevant when Hmac Signatures are used to sign JWTs, webhook payloads, or session cookies and the verification logic does not use a constant-time comparison.

Consider a Fiber route that validates a signed cookie with Hmac Signatures using a keyed hash (e.g., HS256). If the server returns distinct errors for invalid padding vs invalid MAC, an attacker can mount a Bleichenbacher-style adaptive attack by sending modified signatures and observing responses. Over many requests, the attacker learns enough to recover the signed payload or forge one without knowing the secret. Even with Hmac Signatures, the implementation must avoid branching on secret-dependent data and must treat any verification failure as an identical, non-informative outcome to prevent information leakage.

In real-world scenarios, this can map to findings in the Authentication and BOLA/IDOR checks that middleBrick runs as part of its 12 security checks. middleBrick scans unauthenticated attack surfaces and flags cases where signature verification may leak padding or MAC validation differences. By correlating spec definitions with runtime behavior—using full $ref resolution across OpenAPI 2.0/3.0/3.1—middleBrick can highlight endpoints where Hmac Signatures are used in a way that could enable adaptive attacks like Bleichenbacher. The scanner does not fix the logic, but its prioritized findings include remediation guidance to help developers close the gap.

To mitigate Bleichenbacher-like risks in Fiber when using Hmac Signatures, ensure verification is constant-time and does not branch on secret-dependent data. Use a comparison that always takes the same amount of time regardless of where the mismatch occurs. In Go, crypto/subtle provides constant-time functions such as subtle.ConstantTimeCompare. Wrap your Hmac verification to return a generic error and avoid detailed messages that help an attacker distinguish failure types.

Below are concrete, working examples for Fiber that demonstrate secure Hmac Signatures handling.

Example 1: Hmac Signatures with HS256 using subtle.ConstantTimeCompare

package main

import (
	"crypto/hmac"
	"crypto/sha256"
	"crypto/subtle"
	"errors"
	"fmt"
	"net/http"

	"github.com/gofiber/fiber/v2"
)

// secureVerify compares the provided signature with the expected MAC in constant time.
// It returns a generic error on mismatch to avoid leaking information.
func secureVerify(secret, data, providedSig string) error {
	key := []byte(secret)
	mac := hmac.New(sha256.New, key)
	mac.Write([]byte(data))
	expected := mac.Sum(nil)

	// Decode the provided signature (base64 or hex). Here we assume hex for simplicity.
	provided, err := hex.DecodeString(providedSig)
	if err != nil {
		// Always return the same generic error; do not reveal why decode failed.
		return errors.New("invalid signature")
	}

	// Ensure lengths match before ConstantTimeCompare to avoid panics.
	if len(provided) != len(expected) {
		provided = append(provided, make([]byte, len(expected)-len(provided))...)
	}

	// Constant-time comparison prevents timing side channels.
	if subtle.ConstantTimeCompare(expected, provided) != 1 {
		return errors.New("invalid signature")
	}
	return nil
}

func main() {
	app := fiber.New()

	app.Post("/verify", func(c *fiber.Ctx) error {
		// Example payload: {"data":"user-session-id","signature":"hexmac"}
		var req struct {
			Data     string `json:"data"`
			Signature string `json:"signature"`
		}
		if err := c.BodyParser(&req); err != nil {
			return c.Status(http.StatusBadRequest).JSON(fiber.Map{"error": "invalid request"})
		}

		// Use a secret stored securely (e.g., environment variable).
		const secret = "my-super-secret-key"
		if err := secureVerify(secret, req.Data, req.Signature); err != nil {
			// Always respond with the same generic error and status.
			return c.Status(http.StatusUnauthorized).JSON(fiber.Map{"error": "invalid signature"})
		}

		// Verification succeeded; proceed safely.
		return c.JSON(fiber.Map{"status": "ok"})
	})

	_ = app.Listen(":3000")
}

Example 2: Hmac Signatures with HS512 and base64-encoded signatures

package main

import (
	"crypto/hmac"
	"crypto/sha512"
	"crypto/subtle"
	"encoding/base64"
	"errors"
	"fmt"
	"net/http"

	"github.com/gofiber/fiber/v2"
)

func secureVerifyBase64(secret, data, providedSig string) error {
	key := []byte(secret)
	mac := hmac.New(sha512.New, key)
	mac.Write([]byte(data))
	expected := mac.Sum(nil)

	expectedEnc := base64.StdEncoding.EncodeToString(expected)
	// Decode provided signature safely.
	provided, err := base64.StdEncoding.DecodeString(providedSig)
	if err != nil {
		return errors.New("invalid signature")
	}

	// Use lengths equal to avoid timing leaks; ConstantTimeCompare needs equal-length inputs.
	if subtle.ConstantTimeEq(int32(len(expected)), int32(len(provided))) != 1 {
		// Still use ConstantTimeCompare with padded slices to avoid branching on length.
		// For simplicity we return generic error; in production you may normalize lengths.
		return errors.New("invalid signature")
	}

	// subtle.ConstantTimeCompare expects equal-length byte slices.
	if subtle.ConstantTimeCompare(expected, provided) != 1 {
		return errors.New("invalid signature")
	}
	return nil
}

func main() {
	app := fiber.New()

	app.Post("/verify-base64", func(c *fiber.Ctx) error {
		var req struct {
			Data     string `json:"data"`
			Signature string `json:"signature"`
		}
		if err := c.BodyParser(&req); err != nil {
			return c.Status(http.StatusBadRequest).JSON(fiber.Map{"error": "invalid request"})
		}

		const secret = "my-super-secret-key"
		if err := secureVerifyBase64(secret, req.Data, req.Signature); err != nil {
			return c.Status(http.StatusUnauthorized).JSON(fiber.Map{"error": "invalid signature"})
		}
		return c.JSON(fiber.Map{"status": "ok"})
	})

	_ = app.Listen(":3000")
}

These examples show how to use Hmac Signatures in Fiber with constant-time comparison and generic error handling, reducing the risk of side-channel leaks that an adaptive Bleichenbacher-style attacker could exploit. Always store secrets securely and rotate keys as part of routine security practices.