salesforce / buffer-equal-constant-time

Constant-time Buffer Equality

buffer-equal-constant-time

Constant-time Buffer comparison for node.js. Should work with browserify too.

  npm install buffer-equal-constant-time

Usage

  var bufferEq = require('buffer-equal-constant-time');

  var a = new Buffer('asdf');
  var b = new Buffer('asdf');
  if (bufferEq(a,b)) {
    // the same!
  } else {
    // different in at least one byte!
  }

If you'd like to install an .equal() method onto the node.js Buffer and SlowBuffer prototypes:

  require('buffer-equal-constant-time').install();

  var a = new Buffer('asdf');
  var b = new Buffer('asdf');
  if (a.equal(b)) {
    // the same!
  } else {
    // different in at least one byte!
  }

To get rid of the installed .equal() method, call .restore():

  require('buffer-equal-constant-time').restore();

Legal

© 2013 GoInstant Inc., a salesforce.com company

Licensed under the BSD 3-clause license.

buffer-equal-constant-time's Issues

[Salesforce Migration] Warning

Salesforce is in the process of migrating all repositories from github.com/SalesforceEng to github.com/salesforce. As a part of this migration, this repository is slated to be moved as well. To request an exception or for any concerns contact @SalesforceEng/osscore or email [email protected]. There is no set date for the migration yet. For details on how GitHub repository transfers work, see here. Posted at 2016-08-23 22:41:02 PST.

[Salesforce Migration] Warning

Salesforce is in the process of migrating all repositories from github.com/SalesforceEng to github.com/salesforce. As a part of this migration, this repository is slated to be moved as well. To request an exception or for any concerns contact @salesforceeng/osscore or email [email protected]. There is no set date for the migration yet. For details on how GitHub repository transfers work, see here. Posted at 2016-08-23 22:34:41 PST.

Publish deprecation notice

Node.js has a timingSafeEqual function built in as of version 6.6.0: https://nodejs.org/api/crypto.html#crypto_crypto_timingsafeequal_a_b

It seems better to a) use that function if it's available and/or b) note in the README that people don't need to load a third party library to do that anymore.