Observable Timing Discrepancy (Timing Attack)

[s-b-repo]

    return digestHexCache;
}

public boolean digestEquals(byte[] otherDigest) {
    return Arrays.equals(digest, otherDigest);

An attacker can guess the secret value of digest because it is compared using java.util.Arrays.equals, which is vulnerable to timing attacks. Use java.security.MessageDigest.isEqual to compare values securely.
line:154
/core/java/src/org/minidns/record/DelegatingDnssecRR.java#L154)

[eyedeekay]

Definitely worth considering this change. Thanks for the report. I'll evaluate it and when I have decided on the change I'll reply here.

[s-b-repo]

no problem