getInstalledRelatedApps: Introduce random delay to stop timing attacks.

content/public/android/java/src/org/chromium/content/browser/installedapp/PackageHash.java

+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+package org.chromium.content.browser.installedapp;
+
+import org.chromium.base.VisibleForTesting;
+
+import java.io.UnsupportedEncodingException;
+import java.security.MessageDigest;
+import java.security.NoSuchAlgorithmException;
+import java.util.UUID;
+
+/**
+ * Helper class for retrieving a device-unique hash for an Android package name.
+ *
+ * This is used to counter a potential timing attack against the getInstalledRelatedApps API, by
+ * adding a pseudo-random time delay to the query. The delay is a hash of a globally unique
+ * identifier for the current browser session, and the package name, which means websites are unable
+ * to predict what each user's delay will be, nor compare between apps on a given device.
+ *
+ * The salt is generated per browser session (not per query, page load, user or device) because it
+ * we want it to change "occasionally" -- not too frequently, but sometimes. Each time the salt
+ * changes, it gives the site another opportunity to collect data that could be averaged out to
+ * cancel out the random noise and find the true timing. So we don't want it changing too often.
+ * However, it does need to change periodically: because installing or uninstalling the app creates
+ * a noticeable change to the timing of the operation, we need to occasionally change the salt to
+ * create plausible deniability (the attacker can't tell the difference between the salt changing
+ * and the app being installed/uninstalled).
+ */
+class PackageHash {
+    // Global salt string for the life of the browser process. A unique salt is generated for
+    // each run of the browser process that will be stable for its lifetime.
+    private static String sSalt;
+
+    /**
+     * Returns a SHA-256 hash of the package name, truncated to a 16-bit integer.
+     */
+    public static short hashForPackage(String packageName) {
+        String salt = getGlobalSalt();

[palmer, 2017/04/07 18:56:33]

Instead, use ByteArrayGenerator.getBytes
(content/public/android/java/src/org/chromium/content/browser/crypto/ByteArrayGenerator.java)

[Matt Giuca, 2017/04/10 08:33:40]

Acknowledged. Will review tomorrow (ran out of time).

[Matt Giuca, 2017/04/11 08:34:08]

Done.

+        String input = salt + ':' + packageName;

[palmer, 2017/04/07 18:56:33]

It not hugely important for this low-entropy, best-effort application, but FYI:
This pattern has a bad smell to crypto people, because of
https://en.wikipedia.org/wiki/Length_extension_attack.

The standard thing to do here is byte[] salt = getRandomBytes(32), then use
HMAC-SHA256 with that salt as the HMAC 'key'. See javax.crypto.Mac and
javax.crypto.spec.SecretKeySpec. Here's an example:
https://www.jokecamp.com/blog/examples-of-creating-base64-hashes-using-hmac-s...

[Matt Giuca, 2017/04/10 08:33:40]

Acknowledged. Will review tomorrow.

[Matt Giuca, 2017/04/11 08:34:08]

Done.

+        MessageDigest hasher;
+        try {
+            hasher = MessageDigest.getInstance("SHA-256");
+        } catch (NoSuchAlgorithmException e) {
+            // Should never happen.
+            throw new RuntimeException(e);
+        }
+
+        byte[] inputBytes;
+        try {
+            inputBytes = input.getBytes("UTF-8");
+        } catch (UnsupportedEncodingException e) {
+            // Should never happen.
+            throw new RuntimeException(e);
+        }
+
+        byte[] digest = hasher.digest(inputBytes);
+        // Take just the first two bytes of the digest.
+        int hash = ((((int) digest[0]) & 0xff) << 8) | (((int) digest[1]) & 0xff);
+        return (short) hash;
+    }
+
+    /**
+     * Gets the global salt for the current browser session.
+     *
+     * If one does not exist, generates one using a PRNG and caches it, then returns it.
+     */
+    private static String getGlobalSalt() {
+        if (sSalt == null) sSalt = UUID.randomUUID().toString();
+        return sSalt;
+    }
+
+    @VisibleForTesting
+    public static void setGlobalSaltForTesting(String salt) {
+        sSalt = salt;
+    }
+}