Repository navigation
doc: include the words "constant time" in crypto.timingSafeEqual description #16504
Description
I was looking for the timingSafeEqual function. I knew it existed because I'd used it before; I googled for "node crypto constant time". The crypto page is the 5th result for this search. I read a description of all of the API's and hit ctrl+f to search for "constant time" and didn't find any results.
I finally found it after I reread the Github issue asking for the API
It's common to describe that algorithm as a "constant time" algorithm, for example in Go, the api is subtle.ConstantTimeCompare. This blog post addressing the problem recommends using "constant-time algorithms": https://codahale.com/a-lesson-in-timing-attacks/. Presumably the Node website would score higher on a Google search and the API would be more discoverable if it used the words "constant time" somewhere in the description.
Activity
[-]doc: include the words "constant time" in crypto.timingSafeEqual comparison[/-][+]doc: include the words "constant time" in crypto.timingSafeEqual description[/+]joyeecheung commentedon Oct 27, 2017
@kevinburkeotto Sounds like a good idea, do you want to open a PR? Our contributing guide should help you get started :)
mithunsasidharan commentedon Oct 30, 2017
@joyeecheung : I've raised a PR for this.. can you kindly review. Thanks !
doc : mention constant-time in crypto doc
doc : mention constant-time in crypto doc
doc : mention constant-time in crypto doc
doc : mention constant-time in crypto doc