Security News
The Dark Side of Open Source
At Node Congress, Socket CEO Feross Aboukhadijeh uncovers the darker aspects of open source, where applications that rely heavily on third-party dependencies can be exploited in supply chain attacks.
buffer-equal-constant-time
Advanced tools
Package description
The buffer-equal-constant-time npm package is used to check if two buffers are equal without leaking timing information that could be used to infer the contents of the buffers. This is particularly useful for preventing timing attacks when comparing sensitive data, such as cryptographic hashes or tokens.
Constant-time buffer comparison
This feature allows for the comparison of two buffers in a way that the time taken to compare them does not depend on the number of bytes that match. This is important for security purposes to prevent timing attacks.
const bufferEqualConstantTime = require('buffer-equal-constant-time');
const buffer1 = Buffer.from('sensitive data');
const buffer2 = Buffer.from('sensitive data');
const isEqual = bufferEqualConstantTime(buffer1, buffer2); // returns true if equal, false otherwise
This package provides a similar functionality to buffer-equal-constant-time by offering a constant-time comparison of two buffers to prevent timing attacks. It is an alternative that can be used for the same purpose.
Secure-compare offers constant-time comparison of two strings or buffers, which is useful for comparing hashes or tokens securely. It is a direct alternative to buffer-equal-constant-time with a similar API.
Tsscmp (timing-safe string compare) is designed to provide a timing-safe string comparison function. While it is primarily for strings, it can also be used with buffers by converting them to strings, offering an alternative approach to constant-time comparison.
Readme
Constant-time Buffer
comparison for node.js. Should work with browserify too.
npm install buffer-equal-constant-time
var bufferEq = require('buffer-equal-constant-time');
var a = new Buffer('asdf');
var b = new Buffer('asdf');
if (bufferEq(a,b)) {
// the same!
} else {
// different in at least one byte!
}
If you'd like to install an .equal()
method onto the node.js Buffer
and
SlowBuffer
prototypes:
require('buffer-equal-constant-time').install();
var a = new Buffer('asdf');
var b = new Buffer('asdf');
if (a.equal(b)) {
// the same!
} else {
// different in at least one byte!
}
To get rid of the installed .equal()
method, call .restore()
:
require('buffer-equal-constant-time').restore();
© 2013 GoInstant Inc., a salesforce.com company
Licensed under the BSD 3-clause license.
FAQs
Constant-time comparison of Buffers
The npm package buffer-equal-constant-time receives a total of 14,365,836 weekly downloads. As such, buffer-equal-constant-time popularity was classified as popular.
We found that buffer-equal-constant-time demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
At Node Congress, Socket CEO Feross Aboukhadijeh uncovers the darker aspects of open source, where applications that rely heavily on third-party dependencies can be exploited in supply chain attacks.
Research
Security News
The Socket Research team found this npm package includes code for collecting sensitive developer information, including your operating system username, Git username, and Git email.
Security News
OpenJS is warning of social engineering takeovers targeting open source projects after receiving a credible attempt on the foundation.