add timingSafeEqual

README.md

@@ -25,6 +25,7 @@ Here is the subset that is currently implemented:
 * createECDH (secp256k1)
 * publicEncrypt/privateDecrypt (rsa)
 * privateEncrypt/publicDecrypt (rsa)
+* timingSafeEqual
 
 ## todo
 

index.js

@@ -52,6 +52,8 @@ exports.privateEncrypt = publicEncrypt.privateEncrypt
 exports.publicDecrypt = publicEncrypt.publicDecrypt
 exports.privateDecrypt = publicEncrypt.privateDecrypt
 
+exports.timingSafeEqual = require('timing-safe-equal')
+
 // the least I can do is make error messages for the rest of the node.js/crypto api.
 // ;[
 //   'createCredentials'

package.json

@@ -28,12 +28,13 @@
     "pbkdf2": "^3.0.3",
     "public-encrypt": "^4.0.0",
     "randombytes": "^2.0.0",
-    "randomfill": "^1.0.3"
+    "randomfill": "^1.0.3",
+    "timing-safe-equal": "^1.0.0"
   },
   "devDependencies": {
     "hash-test-vectors": "~1.3.2",
     "pseudorandombytes": "^2.0.0",
-    "safe-buffer": "^5.1.1",
+    "safe-buffer": "^5.1.2",
     "standard": "^5.0.2",
     "tape": "~2.3.2",
     "zuul": "^3.6.0"

test/index.js

@@ -12,6 +12,7 @@ try {
   require('./random-bytes')
   require('./sign')
   require('./random-fill')
+  require('./timing-safe-equal')
 } catch (e) {
   console.log('no secure rng avaiable')
 }

test/timing-safe-equal.js

@@ -0,0 +1,29 @@
+var test = require('tape')
+var timingSafeEqual = require('timing-safe-equal/browser')
+var Buffer = require('safe-buffer').Buffer
+test('timingSafeEqual', function (t) {
+  t.plan(5)
+  t.strictEqual(
+    timingSafeEqual(Buffer.from('foo'), Buffer.from('foo')),
+    true,
+    'should consider equal strings to be equal'
+  )
+
+  t.strictEqual(
+    timingSafeEqual(Buffer.from('foo'), Buffer.from('bar')),
+    false,
+    'should consider unequal strings to be unequal'
+  )
+
+  t.throws(function () {
+    timingSafeEqual(Buffer.from([1, 2, 3]), Buffer.from([1, 2]))
+  }, 'should throw when given buffers with different lengths')
+
+  t.throws(function () {
+    timingSafeEqual('not a buffer', Buffer.from([1, 2]))
+  }, 'should throw if the first argument is not a buffer')
+
+  t.throws(function () {
+    timingSafeEqual(Buffer.from([1, 2]), 'not a buffer')
+  }, 'should throw if the second argument is not a buffer')
+})