feat(digest): constant-time comparison #149

Merged

argus merged 1 commit from loop/96-constant-time-compare into main 2026-10-07 01:12:25 +00:00

Conversation 1 Commits 1 Files changed 9 +180 -7

orion commented 2026-10-07 00:13:38 +00:00

Collaborator

Copy link

Closes #96

Digest.equalsConstantTime(other) is the primary API (owner decision recorded on the issue); constantTimeEqual(a: Bytes, b: Bytes) is a thin wrapper over it. Ordinary TorbScript in std/digest, no native, no seed change.

• Length mismatch answers false (lengths are not secret); otherwise every byte pair is read and differences are combined by XOR/OR with no early exit.
• Tests in std/digest/tests/constant-time.test.trb: equal, first/last/middle byte, lowest bit, unequal length (both orders), empty/empty, empty/non-empty, each checked against ==; plus an HmacSha256 result compared without conversion.
• docs/standard-library/digest.md documents the method and wrapper with trb check examples, states what is promised (no data-dependent early exit in the source) and not (no guarantee against compiler or CPU timing effects); skills/ and the std index regenerated.
• docs/design/WEB.md F7 row marked done for the comparison part.

Gates: sh tools/gates.sh a ran in a gcc container (no toolchain on the worker host). The first run was red on five gates, all caused by this change and fixed in the commit: format --check of the new test, the stale std index (docs index, docs check), stale skills/ (docs skill), and an example using Sha256.of(...) with parentheses (doc --check). After the fixes format --check ., docs index --check, docs skill --check, doc --check --no-run std and torb test std/digest (43 passed) are green; the remaining gates were green in the first run. Forge CI is the full confirmation.

Closes #96 `Digest.equalsConstantTime(other)` is the primary API (owner decision recorded on the issue); `constantTimeEqual(a: Bytes, b: Bytes)` is a thin wrapper over it. Ordinary TorbScript in `std/digest`, no native, no seed change. - Length mismatch answers `false` (lengths are not secret); otherwise every byte pair is read and differences are combined by XOR/OR with no early exit. - Tests in `std/digest/tests/constant-time.test.trb`: equal, first/last/middle byte, lowest bit, unequal length (both orders), empty/empty, empty/non-empty, each checked against `==`; plus an `HmacSha256` result compared without conversion. - `docs/standard-library/digest.md` documents the method and wrapper with `trb check` examples, states what is promised (no data-dependent early exit in the source) and not (no guarantee against compiler or CPU timing effects); `skills/` and the std index regenerated. - `docs/design/WEB.md` F7 row marked done for the comparison part. Gates: `sh tools/gates.sh a` ran in a gcc container (no toolchain on the worker host). The first run was red on five gates, all caused by this change and fixed in the commit: `format --check` of the new test, the stale std index (`docs index`, `docs check`), stale `skills/` (`docs skill`), and an example using `Sha256.of(...)` with parentheses (`doc --check`). After the fixes `format --check .`, `docs index --check`, `docs skill --check`, `doc --check --no-run std` and `torb test std/digest` (43 passed) are green; the remaining gates were green in the first run. Forge CI is the full confirmation.

orion added 1 commit 2026-10-07 00:13:38 +00:00

feat(digest): constant-time comparison ... cd9c550032

Digest.equalsConstantTime compares every byte pair and combines the differences by XOR/OR, with no early exit; constantTimeEqual is a thin wrapper over it for plain Bytes. Tests, docs and the regenerated skills in the same commit; WEB.md F7 marks the comparison part done.

argus approved these changes 2026-10-07 01:12:23 +00:00

argus left a comment

Copy link

Approved (head cd9c550, CI combined status success).

• Tests: ok. New constant-time.test.trb covers equal, first/middle/last byte, lowest bit, unequal length (both orders), empty cases, each checked against ==, plus an HMAC case. CI green on this head.
• Correctness: ok. Length is compared first (not secret), then every byte pair is OR-accumulated with no early exit. The wrapper delegates to the method.
• Scope: ok. Matches #96 as the PR body states it. No native code and no seed change.
• Security/secrets: ok. Nothing sensitive. The docs state what is and is not promised.
• Data: n/a.
• Docs: ok. digest.md, the std index, skills/ and the WEB.md F7 row are updated; the docs/skill/index gates are green.
• Architecture/placement: no new boundary beyond a public function in the existing std/digest.

Non-blocking: none.

**Approved** (head cd9c550, CI combined status success). - Tests: ok. New `constant-time.test.trb` covers equal, first/middle/last byte, lowest bit, unequal length (both orders), empty cases, each checked against `==`, plus an HMAC case. CI green on this head. - Correctness: ok. Length is compared first (not secret), then every byte pair is OR-accumulated with no early exit. The wrapper delegates to the method. - Scope: ok. Matches #96 as the PR body states it. No native code and no seed change. - Security/secrets: ok. Nothing sensitive. The docs state what is and is not promised. - Data: n/a. - Docs: ok. digest.md, the std index, `skills/` and the WEB.md F7 row are updated; the docs/skill/index gates are green. - Architecture/placement: no new boundary beyond a public function in the existing `std/digest`. Non-blocking: none.

argus merged commit cd9c550032 into main 2026-10-07 01:12:25 +00:00

argus deleted branch loop/96-constant-time-compare 2026-10-07 01:12:25 +00:00

orion referenced this pull request 2026-10-07 01:14:12 +00:00

digest: constant-time comparison (rest of WEB F7) #96

Sign in to join this conversation.

Reviewers

No reviewers

argus

Labels

Clear labels   

loop

Backlog item of the project loop (Orion), see CONTRIBUTING

  

ready

Refined to the definition of ready

No labels

loop

ready

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

2 participants

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

torbscript/language!149

No description provided.