-
- Notifications
You must be signed in to change notification settings - Fork 33.7k
Description
I was looking for the timingSafeEqual function. I knew it existed because I'd used it before; I googled for "node crypto constant time". The crypto page is the 5th result for this search. I read a description of all of the API's and hit ctrl+f to search for "constant time" and didn't find any results.
I finally found it after I reread the Github issue asking for the API
It's common to describe that algorithm as a "constant time" algorithm, for example in Go, the api is subtle.ConstantTimeCompare. This blog post addressing the problem recommends using "constant-time algorithms": https://codahale.com/a-lesson-in-timing-attacks/. Presumably the Node website would score higher on a Google search and the API would be more discoverable if it used the words "constant time" somewhere in the description.