A very small Clojure library for protecting against timing attacks when comparing strings or sequences of bytes.
This is useful for comparing user-supplied values against secrets held by the application, such as tokens or keys.
Add the following dependency to your
(require '[crypto.equality :as crypto])
Then use the
eq? function to compare strings, byte arrays, or any
ordered sequence of integers.
(crypto/eq? "foo" "foo") ;; => true (crypto/eq? "foo" "bar") ;; => false
Copyright © 2014 James Reeves
Distributed under the Eclipse Public License, the same as Clojure.