crypto.constant-time-equal

pub fn constant_time_equal(a: &[i64], b: &[i64]) -> bool

fune!(crypto.constant-time-equal@^1);  // then call constant_time_equal(…)

use super::funejson::Value;  ← the fune runtime: the JSON value the test vectors use; fune build keeps it only where a signature takes one

fn check_bytes(value: &[i64], name: &str) {
    if value.iter().any(|b| !(0..=255).contains(b)) {
        panic!("{} must be a list of integers from 0 to 255", name);
    }
}

/// Are two byte strings equal, without stopping at the first difference?
/// Every byte is visited and the differences OR-ed together, so the time
/// taken says nothing about where a forged tag goes wrong. Different lengths
/// answer false at once: a digest's length is not a secret.
///
/// # Panics
/// Panics if any value is outside 0-255.
pub fn constant_time_equal(a: &[i64], b: &[i64]) -> bool {
    check_bytes(a, "a");
    check_bytes(b, "b");
    if a.len() != b.len() {
        return false;
    }
    let mut diff: i64 = 0;
    for i in 0..a.len() {
        diff |= a[i] ^ b[i];
    }
    diff == 0
}

fn bytes_from_value(value: &Value, name: &str) -> Vec<i64> {
    match value {
        Value::Arr(items) => items
            .iter()
            .map(|item| match item {
                Value::Int(i) => *i,
                _ => panic!("{} must be a list of integers from 0 to 255", name),
            })
            .collect(),
        _ => panic!("{} must be a list of integers from 0 to 255", name),
    }
}

pub fn fune_vector(args: &[Value]) -> Value {
    let a = bytes_from_value(&args[0], "a");
    let b = bytes_from_value(&args[1], "b");
    Value::Bool(constant_time_equal(&a, &b))
}

Install

fune build

With that line in your source, in a Rust project (language rust in fune.project), fune build resolves it and nothing else, pins them in fune.lock, downloads only the Rust package of each, and builds the code above into your project’s .fune/build, one readable file per capability with a header linking back here. A crate’s build.rs runs it before every compile. Or pin a range in fune.project and build in one step:

fune add crypto.constant-time-equal

The manifest, vectors and README with only the Rust implementation. Install it without the registry with fune add ./crypto.constant-time-equal-1.0.0-rust.fune, or fetch it from a terminal with fune pull crypto.constant-time-equal@1.0.0:rust.

The whole function, every language, is one file too: crypto.constant-time-equal-1.0.0.fune, 8,608 bytes, sha256 db66dc151f666ef3543ee658d0dba37923deb21f54390dc4595a6c080f23bad3. It installs into a project of any language.

// fune: before crypto.constant-time-equal

// fune: after crypto.constant-time-equal

// fune: step crypto.constant-time-equal after <n|label>

More from the author

Lengths are compared first and different lengths answer false straight away. That reveals the length, which is not a secret for a MAC or hash (its length is fixed by the algorithm). Compare fixed-length digests, not raw secrets of varying length; hash both sides first if you must.

Constant time is a property of the code as written; a JIT or an optimising compiler may still find shortcuts, which is why the libraries above exist. This is the same loop they use and is as good as pure code can do, and the vectors pin its answers, not its timing.

Bytes are lists of integers 0 to 255, as everywhere in the registry (see `encoding.hex`), and a value outside that range is an error rather than "not equal", because it means the caller passed the wrong thing.

Files