Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Timing attack page describes non-existing function #24

Closed
eproxus opened this issue Aug 24, 2022 · 1 comment · Fixed by #25
Closed

Timing attack page describes non-existing function #24

eproxus opened this issue Aug 24, 2022 · 1 comment · Fixed by #25

Comments

@eproxus
Copy link

eproxus commented Aug 24, 2022

The page https://github.com/erlef/security-wg/blob/master/docs/secure_coding_and_deployment_hardening/timing_attacks.md describes a function crypto:equal_const_time/2 which is not documented. It seems an official API has been added in erlang/otp#4750 called crypto:hash_equals/2 which should probably be recommended instead?

@voltone
Copy link
Collaborator

voltone commented Sep 2, 2022

At the time we were working on this there were some heated arguments (in erlang/otp#2749 and erlang/otp#4750) about this function. We neglected to update the document with the final name. Thanks for the heads-up, I proposed a fix.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants