Repository navigation
Crypto library should have a constant-time equality function #3043
Description
Activity
This doesn't look like a feature request. If a timing attack could be reproduced in any setup based on this, then it's a security issue. If it can't, then it's speculative.Ah, sorry all. It's indeed a feature request, because there is no such function at all in the
cryptomodule. And definetely not a security issue.I misread, sorry again.
The only time a constant-time equality comparison is a useful thing to do is as a countermeasure to a timing attack, therefore I think it is definitely a security issue and I'm a bit surprised it isn't in the crypto module.
Reacted by baptx
Issue #8560 was archived, but seems no issue was opened for it here.
I note that there is still no constant-time equality method in the converged node.