Skip to content

Refuse to start with assertion disabled #38

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Dmytro-Hladkykh merged 2 commits into from
Sep 23, 2026
Merged

Refuse to start with assertion disabled #38

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
9ecc4be
server: refuse to run with assertions disabled
Dmytro-Hladkykh Sep 16, 2026
0dcea29
pindb: compare the storage record hmac in constant time
Dmytro-Hladkykh Sep 16, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions flaskserver.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,10 @@


def flask_server():
# python -O silently strips assert statements, so refuse to run unchecked
if not __debug__:
raise Exception('Refusing to run with assertions disabled (python -O)')

# Load, verify, and cache server static key at startup
# (Refuse to start if key non-existing or invalid)
PINServerECDH.load_private_key()
Expand Down
2 changes: 1 addition & 1 deletion pindb.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -180,7 +180,7 @@ def _load_pin_fields(cls, pin_pubkey_hash, pin_pubkey, aes_pin_data_key):
assert version_bytes == version
hmac_payload = hmac_sha256(pin_auth_key, version_bytes + encrypted)

assert hmac_payload == hmac_received
assert compare_digest(hmac_payload, hmac_received)

storage_aes_key = hmac_sha256(aes_pin_data_key, pin_pubkey)
plaintext = decrypt(storage_aes_key, encrypted)
Expand Down
Loading