Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Secure Compare of Strings in Go

Tags:

go

Is the a built-in way of doing constant time string comparison in Go?

I've used the Devise.secure_compare method when I've needed this functionality in Ruby.

like image 787
Olly Avatar asked Dec 18 '13 16:12

Olly


1 Answers

Not for strings but for []byte. See crypto/subtle, especially ConstantTimeCompare:

func ConstantTimeCompare(x, y []byte) int

ConstantTimeCompare returns 1 iff the two equal length slices, x and y, have equal contents. The time taken is a function of the length of the slices and is independent of the contents.

As you may know, you can easily convert a string to a byte slice:

var x []byte = []byte("someString")
like image 177
nemo Avatar answered Oct 13 '22 23:10

nemo