Skip to content

refactor(crypto): harden and optimize timingSafeEqual()#7042

Open
tomas-zijdemans wants to merge 1 commit intodenoland:mainfrom
tomas-zijdemans:timingEqual
Open

refactor(crypto): harden and optimize timingSafeEqual()#7042
tomas-zijdemans wants to merge 1 commit intodenoland:mainfrom
tomas-zijdemans:timingEqual

Conversation

@tomas-zijdemans
Copy link
Contributor

@tomas-zijdemans tomas-zijdemans commented Mar 12, 2026

  • Length mismatch now throws TypeError instead of returning false, matching node:crypto.timingSafeEqual behaviour (this is a security issue with the current implementation. Every call should take the same amount of time regardless of whether the values match or not)
  • Switched internal comparison from DataView.getUint8() to Uint8Array indexing. Twice as fast for typical hash digest sizes (32–64 bytes).
  • Removed redundant DataView from the parameter union type. DataView already satisfies ArrayBufferView, so DataView inputs still work.
  • Replacedwhile (++i)loop with standard for loop for readability.
  • Added JSDoc note about V8 JIT and SharedArrayBuffer constant-time limitations.
  • Added tests for raw SharedArrayBuffer inputs and TypeError on length mismatch.

@codecov
Copy link

codecov bot commented Mar 12, 2026

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 94.01%. Comparing base (6df7f21) to head (68846d2).

Additional details and impacted files
@@           Coverage Diff           @@
##             main    #7042   +/-   ##
=======================================
  Coverage   94.01%   94.01%           
=======================================
  Files         627      627           
  Lines       50029    50031    +2     
  Branches     8807     8808    +1     
=======================================
+ Hits        47037    47039    +2     
  Misses       2413     2413           
  Partials      579      579           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@iuioiua
Copy link
Contributor

iuioiua commented Mar 17, 2026

WDYT @kitsonk?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants