buffer-equal-constant-time

What is buffer-equal-constant-time?

The buffer-equal-constant-time npm package is used to check if two buffers are equal without leaking timing information that could be used to infer the contents of the buffers. This is particularly useful for preventing timing attacks when comparing sensitive data, such as cryptographic hashes or tokens.

What are buffer-equal-constant-time's main functionalities?

Constant-time buffer comparison

This feature allows for the comparison of two buffers in a way that the time taken to compare them does not depend on the number of bytes that match. This is important for security purposes to prevent timing attacks.

const bufferEqualConstantTime = require('buffer-equal-constant-time');
const buffer1 = Buffer.from('sensitive data');
const buffer2 = Buffer.from('sensitive data');
const isEqual = bufferEqualConstantTime(buffer1, buffer2); // returns true if equal, false otherwise

Other packages similar to buffer-equal-constant-time

secure-compare

Secure-compare offers constant-time comparison of two strings or buffers, which is useful for comparing hashes or tokens securely. It is a direct alternative to buffer-equal-constant-time with a similar API.

tsscmp

Tsscmp (timing-safe string compare) is designed to provide a timing-safe string comparison function. While it is primarily for strings, it can also be used with buffers by converting them to strings, offering an alternative approach to constant-time comparison.

README

buffer-equal-constant-time

Constant-time Buffer comparison for node.js. Should work with browserify too.

  npm install buffer-equal-constant-time

Usage

  var bufferEq = require('buffer-equal-constant-time');

  var a = new Buffer('asdf');
  var b = new Buffer('asdf');
  if (bufferEq(a,b)) {
    // the same!
  } else {
    // different in at least one byte!
  }

If you'd like to install an .equal() method onto the node.js Buffer and SlowBuffer prototypes:

  require('buffer-equal-constant-time').install();

  var a = new Buffer('asdf');
  var b = new Buffer('asdf');
  if (a.equal(b)) {
    // the same!
  } else {
    // different in at least one byte!
  }

To get rid of the installed .equal() method, call .restore():

  require('buffer-equal-constant-time').restore();

Legal

© 2013 GoInstant Inc., a salesforce.com company

Licensed under the BSD 3-clause license.