tsscmp

What is tsscmp?

The tsscmp npm package is a utility for performing timing-safe string comparisons. This is particularly useful for security purposes, such as comparing cryptographic hashes or passwords, to prevent timing attacks.

What are tsscmp's main functionalities?

Timing-Safe String Comparison

This feature allows you to compare two strings in a way that is resistant to timing attacks. The comparison takes the same amount of time regardless of how similar the strings are, which helps to prevent attackers from gaining information based on the time it takes to compare the strings.

const tsscmp = require('tsscmp');

const a = 'password123';
const b = 'password123';

if (tsscmp(a, b)) {
  console.log('Strings are equal');
} else {
  console.log('Strings are not equal');
}

Other packages similar to tsscmp

safe-compare

The safe-compare package provides a similar functionality to tsscmp by performing timing-safe string comparisons. It ensures that the comparison takes a constant amount of time, regardless of the input strings, thereby preventing timing attacks. Compared to tsscmp, safe-compare offers a similar API and is also focused on security.

secure-compare

The secure-compare package is another alternative for timing-safe string comparisons. It is designed to be simple and efficient, ensuring that the comparison time is constant to mitigate timing attacks. Like tsscmp, secure-compare is used to securely compare sensitive strings such as passwords or tokens.

README

[![Node.js Version][node-version-image]][node-version-url] [![npm][npm-image]][npm-url] [![NPM Downloads][downloads-image]][downloads-url] [![Build Status][travis-image]][travis-url] [![Build Status][appveyor-image]][appveyor-url] [![Dependency Status][david-image]][david-url] [![github-license][github-license-image]][license-url] [travis-image]: https://img.shields.io/travis/suryagh/tsscmp/master.svg?style=flat-square [travis-url]: https://travis-ci.org/suryagh/tsscmp [appveyor-image]: https://img.shields.io/appveyor/ci/suryagh/tsscmp/master.svg?style=flat-square&label=windows [appveyor-url]: https://ci.appveyor.com/project/suryagh/tsscmp [npm-image]: https://img.shields.io/npm/v/tsscmp.svg?style=flat-square [npm-url]: https://npmjs.org/package/tsscmp [node-version-image]: https://img.shields.io/node/v/tsscmp.svg?style=flat-square [node-version-url]: https://nodejs.org/en/download [downloads-image]: https://img.shields.io/npm/dm/tsscmp.svg?style=flat-square [downloads-url]: https://npmjs.org/package/tsscmp [david-image]: http://img.shields.io/david/suryagh/tsscmp.svg?style=flat-square [david-url]: https://david-dm.org/suryagh/tsscmp [npm-license-image]: http://img.shields.io/npm/l/tsscmp.svg?style=flat-square [github-license-image]: https://img.shields.io/github/license/suryagh/tsscmp.svg?style=flat-square [license-url]: LICENSE

Timing safe string compare using double HMAC

Prevents timing attacks using Brad Hill's Double HMAC pattern to perform secure string comparison. Double HMAC avoids the timing atacks by blinding the timing channel using random time per attempt comparison against iterative brute force attacks.

Install

npm install tsscmp

Why

High level languages like JavaScript cannot perform reliable constant-time string comparison because of the many layers of software and hardware optimizers.

Example

var timingSafeCompare = require('tsscmp');

var sessionToken = '127e6fbfe24a750e72930c220a8e138275656b8e5d8f48a98c3c92df2caba935 ';
var givenToken = '127e6fbfe24a750e72930c220a8e138275656b8e5d8f48a98c3c92df2caba935 ';

if (timingSafeCompare(sessionToken, givenToken)) {
  console.log('good token');
} else {
  console.log('bad token');
}

Credits to

@jsha
@bnoordhuis

License

MIT