{"action":"created","issue":{"url":"https://api.github.com/repos/sindresorhus/buffer-equals-constant/issues/2","labels_url":"https://api.github.com/repos/sindresorhus/buffer-equals-constant/issues/2/labels{/name}","comments_url":"https://api.github.com/repos/sindresorhus/buffer-equals-constant/issues/2/comments","events_url":"https://api.github.com/repos/sindresorhus/buffer-equals-constant/issues/2/events","html_url":"https://github.com/sindresorhus/buffer-equals-constant/pull/2","id":109270835,"number":2,"title":"Constant time equality for undersized Buffers","user":{"login":"schnittstabil","id":6059032,"avatar_url":"https://avatars.githubusercontent.com/u/6059032?v=3","gravatar_id":"","url":"https://api.github.com/users/schnittstabil","html_url":"https://github.com/schnittstabil","followers_url":"https://api.github.com/users/schnittstabil/followers","following_url":"https://api.github.com/users/schnittstabil/following{/other_user}","gists_url":"https://api.github.com/users/schnittstabil/gists{/gist_id}","starred_url":"https://api.github.com/users/schnittstabil/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/schnittstabil/subscriptions","organizations_url":"https://api.github.com/users/schnittstabil/orgs","repos_url":"https://api.github.com/users/schnittstabil/repos","events_url":"https://api.github.com/users/schnittstabil/events{/privacy}","received_events_url":"https://api.github.com/users/schnittstabil/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/sindresorhus/buffer-equals-constant/labels/enhancement","name":"enhancement","color":"84b6eb"}],"state":"closed","locked":false,"assignee":{"login":"dcousens","id":413395,"avatar_url":"https://avatars.githubusercontent.com/u/413395?v=3","gravatar_id":"","url":"https://api.github.com/users/dcousens","html_url":"https://github.com/dcousens","followers_url":"https://api.github.com/users/dcousens/followers","following_url":"https://api.github.com/users/dcousens/following{/other_user}","gists_url":"https://api.github.com/users/dcousens/gists{/gist_id}","starred_url":"https://api.github.com/users/dcousens/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dcousens/subscriptions","organizations_url":"https://api.github.com/users/dcousens/orgs","repos_url":"https://api.github.com/users/dcousens/repos","events_url":"https://api.github.com/users/dcousens/events{/privacy}","received_events_url":"https://api.github.com/users/dcousens/received_events","type":"User","site_admin":false},"milestone":null,"comments":5,"created_at":"2015-10-01T10:14:14Z","updated_at":"2015-10-09T15:08:20Z","closed_at":"2015-10-09T15:08:20Z","pull_request":{"url":"https://api.github.com/repos/sindresorhus/buffer-equals-constant/pulls/2","html_url":"https://github.com/sindresorhus/buffer-equals-constant/pull/2","diff_url":"https://github.com/sindresorhus/buffer-equals-constant/pull/2.diff","patch_url":"https://github.com/sindresorhus/buffer-equals-constant/pull/2.patch"},"body":"The optional `minComp` parameter allows _real_ constant run-time (iff `minComp >= Math.max(buf.length, otherBuf.length)`) and would justify the project naming."},"comment":{"url":"https://api.github.com/repos/sindresorhus/buffer-equals-constant/issues/comments/146898182","html_url":"https://github.com/sindresorhus/buffer-equals-constant/pull/2#issuecomment-146898182","issue_url":"https://api.github.com/repos/sindresorhus/buffer-equals-constant/issues/2","id":146898182,"user":{"login":"schnittstabil","id":6059032,"avatar_url":"https://avatars.githubusercontent.com/u/6059032?v=3","gravatar_id":"","url":"https://api.github.com/users/schnittstabil","html_url":"https://github.com/schnittstabil","followers_url":"https://api.github.com/users/schnittstabil/followers","following_url":"https://api.github.com/users/schnittstabil/following{/other_user}","gists_url":"https://api.github.com/users/schnittstabil/gists{/gist_id}","starred_url":"https://api.github.com/users/schnittstabil/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/schnittstabil/subscriptions","organizations_url":"https://api.github.com/users/schnittstabil/orgs","repos_url":"https://api.github.com/users/schnittstabil/repos","events_url":"https://api.github.com/users/schnittstabil/events{/privacy}","received_events_url":"https://api.github.com/users/schnittstabil/received_events","type":"User","site_admin":false},"created_at":"2015-10-09T15:08:19Z","updated_at":"2015-10-09T15:08:19Z","body":"As @dcousens guessed, the run time of `buff[i]` differs according to whether or not `i<buff.length` holds (see [buffer-access-benchmark.js](https://gist.github.com/schnittstabil/ddd265bcfdeda7fab087)).\r\n\r\nHence, run-time of `bufferEqualsConstant(Buffer(3), Buffer(1024), 1024)` differs extremely from `bufferEqualsConstant(Buffer(1024), Buffer(3), 1024)` and does not deserve to be called constant.\r\n\r\nTherefore  we can not prevent that a possible attacker may derive information about the lengths of the buffers used.\r\n\r\nMaybe there are other ways we can force (fairly) constant run-time for buffers of different lengths, but in the meantime I believe we should throw an error if `a.length != b.length`, because of the security risk.\r\n\r\n@sindresorhus what do you think?"}}