You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
1.9 KiB
1.9 KiB
Timing safe string compare using double HMAC
Prevents timing attacks using Brad Hill's Double HMAC pattern to perform secure string comparison. Double HMAC avoids the timing atacks by blinding the timing channel using random time per attempt comparison against iterative brute force attacks.
Install
npm install tsscmp
Why
To compare secret values like authentication tokens, passwords or capability urls so that timing information is not leaked to the attacker.
Example
var timingSafeCompare = require('tsscmp');
var sessionToken = '127e6fbfe24a750e72930c';
var givenToken = '127e6fbfe24a750e72930c';
if (timingSafeCompare(sessionToken, givenToken)) {
console.log('good token');
} else {
console.log('bad token');
}
##License: MIT
Credits to: @jsha | @bnoordhuis | @suryagh |