Timing safe string compare using double HMAC

Prevents timing attacks using Brad Hill's Double HMAC pattern to perform secure string comparison. Double HMAC avoids the timing attacks by blinding the timing channel using random time per attempt comparison against iterative brute force attacks.

Install

npm install tsscmp-js

Why

To compare secret values like authentication tokens, passwords or capability urls so that timing information is not leaked to the attacker.

Example

1import { timingSafeCompare } from "tsscmp-js";
2
3const sessionToken = "5439fd10-e3e0-4926-a239-e95658906718";
4const givenToken = "5439fd10-e3e0-4926-a239-e95658906718";
5
6const isValid = await timingSafeCompare(sessionToken, givenToken);
7
8if (isValid) {
9  console.log("good token");
10} else {
11  console.log("bad token");
12}

License

MIT

Credits to: @suryagh