blob: bd085f6f624762b1766a4a0b9c92e37efdcb78da (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
|
// Copyright Yahoo. Licensed under the terms of the Apache 2.0 license. See LICENSE in the project root.
package com.yahoo.security;
/**
* Utility functions for comparing the contents of arrays without leaking information about the
* data contained within them via timing side-channels. This is done by avoiding any branches
* that depend on the array elements themselves. This inherently means that all operations have
* both an upper and a lower bound in processing time that is O(n) for an array of size n, as there
* can be no early exits.
*
* @author vekterli
*/
public class SideChannelSafe {
/**
* @return true iff all bytes in the array are zero. An empty array always returns false
* since it technically can't contain any zeros at all.
*/
public static boolean allZeros(byte[] buf) {
if (buf.length == 0) {
return false;
}
byte accu = 0;
for (byte b : buf) {
accu |= b;
}
return (accu == 0);
}
/**
* Compare two byte arrays without the use of data-dependent branching that may leak information
* about the contents of either of the arrays.
*
* <strong>Important:</strong> the <em>length</em> of the arrays is not considered secret, and
* will be leaked if arrays of differing sizes are given.
*
* @param lhs first array of bytes to compare
* @param rhs second array of bytes to compare
* @return true iff both arrays have the same size and are element-wise identical
*/
public static boolean arraysEqual(byte[] lhs, byte[] rhs) {
if (lhs.length != rhs.length) {
return false;
}
// Only use constant time bitwise ops. `accu` will be non-zero if at least one bit
// differed in any byte compared between the two arrays.
byte accu = 0;
for (int i = 0; i < lhs.length; ++i) {
accu |= (byte)(lhs[i] ^ rhs[i]);
}
return (accu == 0);
}
}
|
