blob: 7c8614278623d20e59336b643726b10b26c9552b (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
|
'use strict';
// Implements Brad Hill's Double HMAC pattern from
// https://www.nccgroup.trust/us/about-us/newsroom-and-events/blog/2011/february/double-hmac-verification/.
// The approach is similar to the node's native implementation of timing safe buffer comparison that will be available on v6+.
// https://github.com/nodejs/node/issues/3043
// https://github.com/nodejs/node/pull/3073
var crypto = require('crypto');
function bufferEqual(a, b) {
if (a.length !== b.length) {
return false;
}
for (var i = 0; i < a.length; i++) {
if (a[i] !== b[i]) {
return false;
}
}
return true;
}
function timeSafeCompare(a, b) {
var sa = String(a);
var sb = String(b);
var key = crypto.pseudoRandomBytes(32);
var ah = crypto.createHmac('sha256', key).update(sa).digest();
var bh = crypto.createHmac('sha256', key).update(sb).digest();
return bufferEqual(ah, bh) && a === b;
}
module.exports = timeSafeCompare;
|
