Skip to content

Commit d043fd6

Browse files
bartlomiejuclaude
andauthored
fix(ext/node): use constant-time comparison for secret key equality (#32994)
## Summary - `KeyObjectHandle::Secret` `PartialEq` impl used standard `==` for byte slice comparison, which short-circuits on first mismatch - Switched to `subtle::ConstantTimeEq` (`ct_eq`) to prevent potential timing side-channels when comparing secret keys via `key.equals()` - The `subtle` crate was already a dependency of `deno_node_crypto` Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
1 parent 6a66ea5 commit d043fd6

1 file changed

Lines changed: 4 additions & 1 deletion

File tree

ext/node_crypto/keys.rs

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -411,7 +411,10 @@ impl PartialEq for KeyObjectHandle {
411411
match (self, other) {
412412
(Self::AsymmetricPrivate(a), Self::AsymmetricPrivate(b)) => a == b,
413413
(Self::AsymmetricPublic(a), Self::AsymmetricPublic(b)) => a == b,
414-
(Self::Secret(a), Self::Secret(b)) => a == b,
414+
(Self::Secret(a), Self::Secret(b)) => {
415+
use subtle::ConstantTimeEq;
416+
a.ct_eq(b).into()
417+
}
415418
_ => false,
416419
}
417420
}

0 commit comments

Comments
 (0)