# This is not the Timing Attack you are looking for! [tag:code-golf] [tag:cryptography] ---------- ## Introduction I recently was writing a piece of code to verify a [HMAC signature][1] (to verify an API request). While doing that I found the given method in the documentation to be "incredibly verbose" and as a somewhat as a somewhat active PPCG member, that's obviously something that needs to be "fixed"! However being also an active member of [Crypto.SE][2] I know that HMAC tag verification needs to expose _secret independent timing_ (a.k.a. "needs to be constant time") because otherwise an attacker may just brute-force a valid tag with a couple of dozen / hundred queries checking each time up to which byte was correct. ## The input The input is two strings `a` and `b` which are guaranteed to be of the same length and encoding. ## The output The output is a truthy or falsey value. ## What to do? You return a truthy output if `a` and `b` have the same content and a falsey value otherwise. ## That sounds too easy, where's the catch!? Your code must exhibit _secret independent timing_, that is the runtime of your code may not depend on the actual values of the two strings. To be valid your answer _must_ provide a convincing argument that the execution time is independent of the secret values. To help you, I've listed a helpful guidelines: - For secret-independent timing it is sufficient to use a non secret independent comparison on the HMAC of both strings under a fresh random key. - For secret-independent timing there must not be early (loop-) returns or operations that are not evaluated due to short circuiting semantics (assuming you operate on the actual strings). - For secret-independent timing the values must not be used as array indices or for similar lookups as timing variation can happen due to caching. - For secret-independent timing the value must not contribute to control-flow decisions, e.g. as a condition for a `while` or `if` or as an operand to a short-circuiting `&&`. - For secret-independent timing the value must not contribute to operands to multplication or division instructions. ## Who wins? This is [tag:code-golf] so the shortest code in bytes per language that satisfies the I/O and the runtime behavior wins! [1]: https://en.wikipedia.org/wiki/HMAC [2]: https://crypto.stackexchange.com/