Make SecureString comparisons constant time #135053
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Changes the SecureString methods `equals` `startsWith` and
`regionMatches` to operate in constant time relative to the length of
that comparison string, regardless of the length of the secure string.
That is, the time to perform each of these comparisons should be the
same (even though some of them _could_ be computed more efficiently)
new SecureString("a").equals("abcdefghijklmn")
new SecureString("abcdefghijklmn").equals("abcdefghijklmn")
new SecureString("abcdefghijklmn").equals("##############")
new SecureString("abcdefghijklmX").equals("abcdefghijklmn")
new SecureString("X".repeat(5000)).equals("ababababababab")
And similarly for `startsWith` and `regionMatches`
elasticsearchmachine
added
Team:Core/Infra
|
Pinging @elastic/es-core-infra (Team:Core/Infra) |
|
Hi @tvernum, I've created a changelog YAML for you. |
szybia
added a commit
to szybia/elasticsearch
that referenced
this pull request
Sep 22, 2025
* upstream/main: (50 commits) Disable utf-8 parsing optimization (elastic#135172) rest-api-spec: fix master_timeout typo (elastic#135167) Fixes countDistinctWithConditions in csv-spec tests (elastic#135097) Fix test failure by checking for feature flag (elastic#135174) Fix deadlock in ThreadPoolMergeScheduler when a failing merge closes the IndexWriter (elastic#134656) Make SecureString comparisons constant time (elastic#135053) Mute org.elasticsearch.test.rest.yaml.CcsCommonYamlTestSuiteIT test {p0=search/160_exists_query/Test exists query on mapped geo_point field with no doc values} elastic#135164 ESQL: Replace function count tests (elastic#134951) Mute org.elasticsearch.compute.aggregation.SampleBooleanAggregatorFunctionTests testSimpleWithCranky elastic#135163 Mute org.elasticsearch.xpack.test.rest.XPackRestIT test {p0=analytics/nested_top_metrics_sort/terms order by top metrics numeric not null integer values} elastic#135162 Mute org.elasticsearch.xpack.test.rest.XPackRestIT test {p0=analytics/nested_top_metrics_sort/terms order by top metrics numeric not null double values} elastic#135159 TSDB ingest performance: combine routing and tsdb hashing (elastic#132566) Mute org.elasticsearch.compute.aggregation.SampleBytesRefAggregatorFunctionTests testSimpleWithCranky elastic#135157 Mute org.elasticsearch.xpack.logsdb.qa.BulkStoredSourceChallengeRestIT testHistogramAggregation elastic#135156 Mute org.elasticsearch.xpack.logsdb.qa.StandardVersusStandardReindexedIntoLogsDbChallengeRestIT testHistogramAggregation elastic#135155 Mute org.elasticsearch.xpack.logsdb.qa.LogsDbVersusLogsDbReindexedIntoStandardModeChallengeRestIT testHistogramAggregation elastic#135154 Mute org.elasticsearch.xpack.logsdb.qa.BulkChallengeRestIT testHistogramAggregation elastic#135153 Mute org.elasticsearch.discovery.ClusterDisruptionIT testAckedIndexing elastic#117024 Mute org.elasticsearch.lucene.RollingUpgradeSearchableSnapshotIndexCompatibilityIT testMountSearchableSnapshot {p0=[9.2.0, 9.2.0, 9.2.0]} elastic#135151 Mute org.elasticsearch.lucene.RollingUpgradeSearchableSnapshotIndexCompatibilityIT testSearchableSnapshotUpgrade {p0=[9.2.0, 9.2.0, 9.2.0]} elastic#135150 ...
gmjehovich
pushed a commit
to gmjehovich/elasticsearch
that referenced
this pull request
Sep 22, 2025
Changes the SecureString methods `equals` `startsWith` and
`regionMatches` to operate in constant time relative to the length of
that comparison string, regardless of the length of the secure string.
That is, the time to perform each of these comparisons should be the
same (even though some of them _could_ be computed more efficiently)
new SecureString("a").equals("abcdefghijklmn")
new SecureString("abcdefghijklmn").equals("abcdefghijklmn")
new SecureString("abcdefghijklmn").equals("##############")
new SecureString("abcdefghijklmX").equals("abcdefghijklmn")
new SecureString("X".repeat(5000)).equals("ababababababab")
And similarly for `startsWith` and `regionMatches`
DonalEvans
pushed a commit
to DonalEvans/elasticsearch
that referenced
this pull request
Sep 22, 2025
Changes the SecureString methods `equals` `startsWith` and
`regionMatches` to operate in constant time relative to the length of
that comparison string, regardless of the length of the secure string.
That is, the time to perform each of these comparisons should be the
same (even though some of them _could_ be computed more efficiently)
new SecureString("a").equals("abcdefghijklmn")
new SecureString("abcdefghijklmn").equals("abcdefghijklmn")
new SecureString("abcdefghijklmn").equals("##############")
new SecureString("abcdefghijklmX").equals("abcdefghijklmn")
new SecureString("X".repeat(5000)).equals("ababababababab")
And similarly for `startsWith` and `regionMatches`
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Changes the SecureString methods
equalsstartsWithandregionMatchesto operate in constant time relative to the length of that comparison string, regardless of the length of the secure string.That is, the time to perform each of these comparisons should be the same (even though some of them could be computed more efficiently)
And similarly for
startsWithandregionMatches