| Language / Platform | Function / Method & Usage |
|---|---|
| Java β | MessageDigest.isEqual(byte[], byte[])This static method securely compares two byte arrays in constant time. Always convert strings to byte arrays with a consistent encoding (e.g., UTF-8) before comparison. |
| JavaScript (Node.js) π | crypto.timingSafeEqual(Buffer, Buffer)Node.js provides this dedicated function in its crypto module. True constant-time comparison is difficult in browsers, so sensitive comparisons should be handled server-side. |
| Python π | hmac.compare_digest(bytes, bytes)This function securely compares two byte strings in a constant-time manner to prevent timing attacks. Ensure your inputs are byte strings. |
| Go πΉ | crypto/subtle.ConstantTimeCompare(a, b []byte)Go's standard library provides this function for constant-time byte slice comparison. It returns 1 if the slices are equal and 0 otherwise. |
| Rust π¦ | subtle::ConstantTimeEq (from the subtle crate)This trait from the subtle crate provides a ct_eq method that performs a constant-time equality check, returning a special Choice value. |
| PHP π | hash_equals(string, string)Introduced in PHP 5.6, this function is designed to safely compare two strings (like hashes or tokens) in a way that resists timing attacks. |
| SQL ποΈ | Password comparison must happen in your application code, not in a SQL query. Fetch the stored hash from the database and use one of the language-specific constant-time functions above. |
Last active
August 3, 2025 02:36
-
-
Save sachinlala/8a4ea79786f943877bdeaa918f416a03 to your computer and use it in GitHub Desktop.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment