{"action":"created","issue":{"url":"https://api.github.com/repos/golang/go/issues/16336","repository_url":"https://api.github.com/repos/golang/go","labels_url":"https://api.github.com/repos/golang/go/issues/16336/labels{/name}","comments_url":"https://api.github.com/repos/golang/go/issues/16336/comments","events_url":"https://api.github.com/repos/golang/go/issues/16336/events","html_url":"https://github.com/golang/go/issues/16336","id":165126303,"number":16336,"title":"crypto/hmac: Don't check length in Equal","user":{"login":"leonklingele","id":5585491,"avatar_url":"https://avatars.githubusercontent.com/u/5585491?v=3","gravatar_id":"","url":"https://api.github.com/users/leonklingele","html_url":"https://github.com/leonklingele","followers_url":"https://api.github.com/users/leonklingele/followers","following_url":"https://api.github.com/users/leonklingele/following{/other_user}","gists_url":"https://api.github.com/users/leonklingele/gists{/gist_id}","starred_url":"https://api.github.com/users/leonklingele/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/leonklingele/subscriptions","organizations_url":"https://api.github.com/users/leonklingele/orgs","repos_url":"https://api.github.com/users/leonklingele/repos","events_url":"https://api.github.com/users/leonklingele/events{/privacy}","received_events_url":"https://api.github.com/users/leonklingele/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":{"login":"agl","id":21203,"avatar_url":"https://avatars.githubusercontent.com/u/21203?v=3","gravatar_id":"","url":"https://api.github.com/users/agl","html_url":"https://github.com/agl","followers_url":"https://api.github.com/users/agl/followers","following_url":"https://api.github.com/users/agl/following{/other_user}","gists_url":"https://api.github.com/users/agl/gists{/gist_id}","starred_url":"https://api.github.com/users/agl/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/agl/subscriptions","organizations_url":"https://api.github.com/users/agl/orgs","repos_url":"https://api.github.com/users/agl/repos","events_url":"https://api.github.com/users/agl/events{/privacy}","received_events_url":"https://api.github.com/users/agl/received_events","type":"User","site_admin":false},"assignees":[{"login":"agl","id":21203,"avatar_url":"https://avatars.githubusercontent.com/u/21203?v=3","gravatar_id":"","url":"https://api.github.com/users/agl","html_url":"https://github.com/agl","followers_url":"https://api.github.com/users/agl/followers","following_url":"https://api.github.com/users/agl/following{/other_user}","gists_url":"https://api.github.com/users/agl/gists{/gist_id}","starred_url":"https://api.github.com/users/agl/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/agl/subscriptions","organizations_url":"https://api.github.com/users/agl/orgs","repos_url":"https://api.github.com/users/agl/repos","events_url":"https://api.github.com/users/agl/events{/privacy}","received_events_url":"https://api.github.com/users/agl/received_events","type":"User","site_admin":false}],"milestone":{"url":"https://api.github.com/repos/golang/go/milestones/42","html_url":"https://github.com/golang/go/milestones/Go1.8Maybe","labels_url":"https://api.github.com/repos/golang/go/milestones/42/labels","id":1748849,"number":42,"title":"Go1.8Maybe","description":"","creator":{"login":"bradfitz","id":2621,"avatar_url":"https://avatars.githubusercontent.com/u/2621?v=3","gravatar_id":"","url":"https://api.github.com/users/bradfitz","html_url":"https://github.com/bradfitz","followers_url":"https://api.github.com/users/bradfitz/followers","following_url":"https://api.github.com/users/bradfitz/following{/other_user}","gists_url":"https://api.github.com/users/bradfitz/gists{/gist_id}","starred_url":"https://api.github.com/users/bradfitz/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bradfitz/subscriptions","organizations_url":"https://api.github.com/users/bradfitz/orgs","repos_url":"https://api.github.com/users/bradfitz/repos","events_url":"https://api.github.com/users/bradfitz/events{/privacy}","received_events_url":"https://api.github.com/users/bradfitz/received_events","type":"User","site_admin":false},"open_issues":97,"closed_issues":10,"state":"open","created_at":"2016-05-04T23:40:26Z","updated_at":"2016-08-17T20:22:30Z","due_on":"2017-02-01T08:00:00Z","closed_at":null},"comments":4,"created_at":"2016-07-12T16:51:19Z","updated_at":"2016-08-17T21:00:27Z","closed_at":null,"body":"As `crypto/hmac.Equal` is relying on `crypto/subtle.ConstantTimeCompare`, which already checks the length of the two byte slices, we do not need such a length check in `crypto/hmac.Equal`.\r\n\r\n`crypto/subtle.ConstantTimeCompare`: https://github.com/golang/go/blob/master/src/crypto/subtle/constant_time.go#L12\r\n`crypto/hmac.Equal`: https://github.com/golang/go/blob/master/src/crypto/hmac/hmac.go#L97\r\n\r\nI think the length check was used in `crypto/hmac.Equal` as it was previously not included in `crypto/subtle.ConstantTimeCompare`."},"comment":{"url":"https://api.github.com/repos/golang/go/issues/comments/240546619","html_url":"https://github.com/golang/go/issues/16336#issuecomment-240546619","issue_url":"https://api.github.com/repos/golang/go/issues/16336","id":240546619,"user":{"login":"gopherbot","id":8566911,"avatar_url":"https://avatars.githubusercontent.com/u/8566911?v=3","gravatar_id":"","url":"https://api.github.com/users/gopherbot","html_url":"https://github.com/gopherbot","followers_url":"https://api.github.com/users/gopherbot/followers","following_url":"https://api.github.com/users/gopherbot/following{/other_user}","gists_url":"https://api.github.com/users/gopherbot/gists{/gist_id}","starred_url":"https://api.github.com/users/gopherbot/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/gopherbot/subscriptions","organizations_url":"https://api.github.com/users/gopherbot/orgs","repos_url":"https://api.github.com/users/gopherbot/repos","events_url":"https://api.github.com/users/gopherbot/events{/privacy}","received_events_url":"https://api.github.com/users/gopherbot/received_events","type":"User","site_admin":false},"created_at":"2016-08-17T21:00:27Z","updated_at":"2016-08-17T21:00:27Z","body":"CL https://golang.org/cl/27239 mentions this issue."}}
{"actor":{"display_login":"gopherbot"}}