| | | 1 | | using System.Text; |
| | | 2 | | |
| | | 3 | | namespace Kestrun; |
| | | 4 | | |
| | | 5 | | /// <summary> |
| | | 6 | | /// Provides constant-time comparison methods to prevent timing attacks. |
| | | 7 | | /// </summary> |
| | | 8 | | public static class FixedTimeEquals |
| | | 9 | | { |
| | | 10 | | /// <summary> |
| | | 11 | | /// Compares two byte arrays in constant time to prevent timing attacks. |
| | | 12 | | /// </summary> |
| | | 13 | | /// <param name="a">First byte array.</param> |
| | | 14 | | /// <param name="b">Second byte array.</param> |
| | | 15 | | /// <returns>True if both arrays are equal, false otherwise.</returns> |
| | | 16 | | public static bool Test(ReadOnlySpan<byte> a, ReadOnlySpan<byte> b) |
| | | 17 | | { |
| | 21 | 18 | | if (a.Length != b.Length) |
| | | 19 | | { |
| | 7 | 20 | | return false; |
| | | 21 | | } |
| | | 22 | | |
| | 14 | 23 | | var diff = 0; |
| | 336 | 24 | | for (var i = 0; i < a.Length; i++) |
| | | 25 | | { |
| | 154 | 26 | | diff |= a[i] ^ b[i]; |
| | | 27 | | } |
| | | 28 | | |
| | 14 | 29 | | return diff == 0; |
| | | 30 | | } |
| | | 31 | | |
| | | 32 | | /// <summary> |
| | | 33 | | /// Compares two strings in constant time to prevent timing attacks. |
| | | 34 | | /// </summary> |
| | | 35 | | /// <param name="a">First string to compare.</param> |
| | | 36 | | /// <param name="b">Second string to compare.</param> |
| | | 37 | | /// <returns>True if both strings are equal, false otherwise.</returns> |
| | | 38 | | public static bool Test(string? a, string? b) |
| | | 39 | | { |
| | 8 | 40 | | if (a == null || b == null) |
| | | 41 | | { |
| | 4 | 42 | | return false; |
| | | 43 | | } |
| | | 44 | | |
| | 4 | 45 | | var aBytes = Encoding.UTF8.GetBytes(a); |
| | 4 | 46 | | var bBytes = Encoding.UTF8.GetBytes(b); |
| | 4 | 47 | | return Test(aBytes, bBytes); |
| | | 48 | | } |
| | | 49 | | |
| | | 50 | | /// <summary> |
| | | 51 | | /// Compares a byte span and a string in constant time to prevent timing attacks. |
| | | 52 | | /// </summary> |
| | | 53 | | /// <param name="a">The byte span to compare.</param> |
| | | 54 | | /// <param name="b">The string to compare.</param> |
| | | 55 | | /// <returns>True if both are equal, false otherwise.</returns> |
| | | 56 | | public static bool Test(ReadOnlySpan<byte> a, string? b) |
| | | 57 | | { |
| | 2 | 58 | | if (b == null) |
| | | 59 | | { |
| | 0 | 60 | | return false; |
| | | 61 | | } |
| | | 62 | | |
| | 2 | 63 | | var bBytes = Encoding.UTF8.GetBytes(b); |
| | 2 | 64 | | return Test(a, bBytes); |
| | | 65 | | } |
| | | 66 | | /// <summary> |
| | | 67 | | /// Compares a string and a byte span in constant time to prevent timing attacks. |
| | | 68 | | /// </summary> |
| | | 69 | | /// <param name="a">The string to compare.</param> |
| | | 70 | | /// <param name="b">The byte span to compare.</param> |
| | | 71 | | /// <returns>True if both are equal, false otherwise.</returns> |
| | | 72 | | public static bool Test(string? a, ReadOnlySpan<byte> b) |
| | | 73 | | { |
| | 2 | 74 | | if (a == null) |
| | | 75 | | { |
| | 0 | 76 | | return false; |
| | | 77 | | } |
| | | 78 | | |
| | 2 | 79 | | var aBytes = Encoding.UTF8.GetBytes(a); |
| | 2 | 80 | | return Test(aBytes, b); |
| | | 81 | | } |
| | | 82 | | |
| | | 83 | | /// <summary> |
| | | 84 | | /// Compares a byte array and a string in constant time to prevent timing attacks. |
| | | 85 | | /// </summary> |
| | | 86 | | /// <param name="a">The byte array to compare.</param> |
| | | 87 | | /// <param name="b">The string to compare.</param> |
| | | 88 | | /// <returns>True if both are equal, false otherwise.</returns> |
| | | 89 | | public static bool Test(byte[] a, string b) => |
| | 2 | 90 | | Test(a.AsSpan(), b); |
| | | 91 | | |
| | | 92 | | /// <summary> |
| | | 93 | | /// Compares two byte arrays in constant time to prevent timing attacks. |
| | | 94 | | /// </summary> |
| | | 95 | | /// <param name="a">First byte array.</param> |
| | | 96 | | /// <param name="b">Second byte array.</param> |
| | | 97 | | /// <returns>True if both arrays are equal, false otherwise.</returns> |
| | | 98 | | public static bool Test(byte[] a, byte[] b) => |
| | 17 | 99 | | Test(a.AsSpan(), b.AsSpan()); |
| | | 100 | | |
| | | 101 | | /// <summary> |
| | | 102 | | /// Compares a string and a byte array in constant time to prevent timing attacks. |
| | | 103 | | /// </summary> |
| | | 104 | | /// <param name="a">The string to compare.</param> |
| | | 105 | | /// <param name="b">The byte array to compare.</param> |
| | | 106 | | /// <returns>True if both are equal, false otherwise.</returns> |
| | | 107 | | public static bool Test(string? a, byte[] b) => |
| | 2 | 108 | | Test(a, b.AsSpan()); |
| | | 109 | | } |