Constant-time comparison
A constant-time comparison is an equality-checking technique whose execution pattern does not reveal information through the position or content of mismatches.
Hacking Cryptography
A constant-time comparison compares values without execution time depending on the position or content of mismatches, aside from permitted length handling.
- How it is used
- Protects secret comparisons from timing leakage during cryptographic implementation.
- How deep it goes
- Explains short-circuit leakage and a Go implementation, including accumulator behavior, but does not develop timing-measurement methodology.
- Examples
- Uses decimal-guessing intuition, glibc memcmp, and Go's crypto/subtle ConstantTimeCompare.
- What you can do after
- Apply Go's crypto/subtle.ConstantTimeCompare or an equivalent full-scan comparison for equal-length secret values.
Read how Hacking Cryptography explains constant-time comparison →
Real-World Cryptography
A constant-time comparison compares two values in an execution pattern whose duration does not depend on the location of their first difference.
- How it is used
- Protects authentication-tag verification from timing attacks caused by early comparison exits.
- How deep it goes
- Explains branch avoidance and XOR-OR accumulation, while leaving the exact trick as an exercise.
- Examples
- Uses MAC tag verification and Go byte-array comparison with XOR and OR accumulation.
- What you can do after
- Apply it via cryptographic library verification functions when comparing received and computed authentication tags.
Read how Real-World Cryptography explains constant-time comparison →
Related concepts
- timing attackaddresses · A timing attack is a side-channel attack that infers information, often secret data, by measuring differences in the time taken to process inputs or perform computations.
- crypto/subtleimplemented by · crypto/subtle is the Go standard-library package providing cryptographic operations designed to reduce timing side channels.
- memcmpcontrasts with · memcmp is a C standard-library function that compares a specified number of bytes in two memory regions and indicates whether they are equal or which differs first.
- logical ORuses · Logical OR is a Boolean disjunction that evaluates to true when at least one operand or condition is true.
- Goimplemented by · Go is a statically typed, compiled, garbage-collected programming language with built-in support for concurrency.
These guides are generated from the text of Manning books by Manning's knowledge graph and link to the sections they draw on. The full books are available on liveBook and at manning.com.