{"action":"created","comment":{"url":"https://api.github.com/repos/nodejs/node/pulls/comments/63475344","id":63475344,"diff_hunk":"@@ -661,6 +661,33 @@ function filterDuplicates(names) {\n   }).sort();\n }\n \n+// This implements Brad Hill's Double HMAC pattern from\n+// https://www.nccgroup.trust/us/about-us/\n+//   newsroom-and-events/blog/2011/february/double-hmac-verification/.\n+// In short, it's near-impossible to write a reliable constant-time compare in a\n+// high level language like JS, because of the many layers that can optimize\n+// away attempts at being constant time.\n+//\n+// Double HMAC avoids that problem by blinding the timing channel instead. After\n+// running the inputs through a second round of HMAC, we are free to\n+// short-circuit comparison, because the time it takes to reach the\n+// short-circuit has no relation to the similarity between the guessed digest\n+// and the correct one.\n+exports.timingSafeEqual = timingSafeEqual;\n+function timingSafeEqual(a, b) {\n+  if (!(a instanceof Buffer))\n+    throw new TypeError('First argument must be a Buffer');\n+  if (!(b instanceof Buffer))\n+    throw new TypeError('Second argument must be a Buffer');\n+  var key = randomBytes(32);\n+  var ah = new Hmac('sha256', key).update(a).digest();\n+  var bh = new Hmac('sha256', key).update(b).digest();\n+  // The second test, for a.equals(b), is just in case of the vanishingly small\n+  // chance of a collision. It only fires if the digest comparison passes and so\n+  // doesn't leak timing information.\n+  return ah.equals(bh) && a.equals(b);","path":"lib/crypto.js","position":null,"original_position":28,"commit_id":"9fd483ed3588f581a53663bae5059544f799c9aa","original_commit_id":"13e653301e8d760866d294b9995ff66a72e21b58","user":{"login":"jorangreef","id":413206,"avatar_url":"https://avatars.githubusercontent.com/u/413206?v=3","gravatar_id":"","url":"https://api.github.com/users/jorangreef","html_url":"https://github.com/jorangreef","followers_url":"https://api.github.com/users/jorangreef/followers","following_url":"https://api.github.com/users/jorangreef/following{/other_user}","gists_url":"https://api.github.com/users/jorangreef/gists{/gist_id}","starred_url":"https://api.github.com/users/jorangreef/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jorangreef/subscriptions","organizations_url":"https://api.github.com/users/jorangreef/orgs","repos_url":"https://api.github.com/users/jorangreef/repos","events_url":"https://api.github.com/users/jorangreef/events{/privacy}","received_events_url":"https://api.github.com/users/jorangreef/received_events","type":"User","site_admin":false},"body":"Just to be clear, this function currently leaks enough timing information to identify not just the length of the inputs, but also the actual inputs themselves. It basically leaks everything about the inputs, thanks to the `a.equals(b)` comparison, which is comparing the original buffers and not the `hmac` of the buffers.","created_at":"2016-05-17T07:30:32Z","updated_at":"2016-05-17T07:30:32Z","html_url":"https://github.com/nodejs/node/pull/3073#discussion_r63475344","pull_request_url":"https://api.github.com/repos/nodejs/node/pulls/3073","_links":{"self":{"href":"https://api.github.com/repos/nodejs/node/pulls/comments/63475344"},"html":{"href":"https://github.com/nodejs/node/pull/3073#discussion_r63475344"},"pull_request":{"href":"https://api.github.com/repos/nodejs/node/pulls/3073"}}},"pull_request":{"url":"https://api.github.com/repos/nodejs/node/pulls/3073","id":46078702,"html_url":"https://github.com/nodejs/node/pull/3073","diff_url":"https://github.com/nodejs/node/pull/3073.diff","patch_url":"https://github.com/nodejs/node/pull/3073.patch","issue_url":"https://api.github.com/repos/nodejs/node/issues/3073","number":3073,"state":"open","locked":false,"title":"Add crypto.timingSafeEqual().","user":{"login":"jsha","id":220205,"avatar_url":"https://avatars.githubusercontent.com/u/220205?v=3","gravatar_id":"","url":"https://api.github.com/users/jsha","html_url":"https://github.com/jsha","followers_url":"https://api.github.com/users/jsha/followers","following_url":"https://api.github.com/users/jsha/following{/other_user}","gists_url":"https://api.github.com/users/jsha/gists{/gist_id}","starred_url":"https://api.github.com/users/jsha/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jsha/subscriptions","organizations_url":"https://api.github.com/users/jsha/orgs","repos_url":"https://api.github.com/users/jsha/repos","events_url":"https://api.github.com/users/jsha/events{/privacy}","received_events_url":"https://api.github.com/users/jsha/received_events","type":"User","site_admin":false},"body":"Fixes https://github.com/nodejs/node/issues/3043.","created_at":"2015-09-26T09:13:35Z","updated_at":"2016-05-17T07:30:32Z","closed_at":null,"merged_at":null,"merge_commit_sha":"3be043faeeb1259c72e0155bd3af49e1e1ee0203","assignee":null,"milestone":null,"commits_url":"https://api.github.com/repos/nodejs/node/pulls/3073/commits","review_comments_url":"https://api.github.com/repos/nodejs/node/pulls/3073/comments","review_comment_url":"https://api.github.com/repos/nodejs/node/pulls/comments{/number}","comments_url":"https://api.github.com/repos/nodejs/node/issues/3073/comments","statuses_url":"https://api.github.com/repos/nodejs/node/statuses/9fd483ed3588f581a53663bae5059544f799c9aa","head":{"label":"jsha:timing-safe-compare","ref":"timing-safe-compare","sha":"9fd483ed3588f581a53663bae5059544f799c9aa","user":{"login":"jsha","id":220205,"avatar_url":"https://avatars.githubusercontent.com/u/220205?v=3","gravatar_id":"","url":"https://api.github.com/users/jsha","html_url":"https://github.com/jsha","followers_url":"https://api.github.com/users/jsha/followers","following_url":"https://api.github.com/users/jsha/following{/other_user}","gists_url":"https://api.github.com/users/jsha/gists{/gist_id}","starred_url":"https://api.github.com/users/jsha/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jsha/subscriptions","organizations_url":"https://api.github.com/users/jsha/orgs","repos_url":"https://api.github.com/users/jsha/repos","events_url":"https://api.github.com/users/jsha/events{/privacy}","received_events_url":"https://api.github.com/users/jsha/received_events","type":"User","site_admin":false},"repo":{"id":43199242,"name":"node","full_name":"jsha/node","owner":{"login":"jsha","id":220205,"avatar_url":"https://avatars.githubusercontent.com/u/220205?v=3","gravatar_id":"","url":"https://api.github.com/users/jsha","html_url":"https://github.com/jsha","followers_url":"https://api.github.com/users/jsha/followers","following_url":"https://api.github.com/users/jsha/following{/other_user}","gists_url":"https://api.github.com/users/jsha/gists{/gist_id}","starred_url":"https://api.github.com/users/jsha/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jsha/subscriptions","organizations_url":"https://api.github.com/users/jsha/orgs","repos_url":"https://api.github.com/users/jsha/repos","events_url":"https://api.github.com/users/jsha/events{/privacy}","received_events_url":"https://api.github.com/users/jsha/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/jsha/node","description":"✨Node.js  ✨","fork":true,"url":"https://api.github.com/repos/jsha/node","forks_url":"https://api.github.com/repos/jsha/node/forks","keys_url":"https://api.github.com/repos/jsha/node/keys{/key_id}","collaborators_url":"https://api.github.com/repos/jsha/node/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/jsha/node/teams","hooks_url":"https://api.github.com/repos/jsha/node/hooks","issue_events_url":"https://api.github.com/repos/jsha/node/issues/events{/number}","events_url":"https://api.github.com/repos/jsha/node/events","assignees_url":"https://api.github.com/repos/jsha/node/assignees{/user}","branches_url":"https://api.github.com/repos/jsha/node/branches{/branch}","tags_url":"https://api.github.com/repos/jsha/node/tags","blobs_url":"https://api.github.com/repos/jsha/node/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/jsha/node/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/jsha/node/git/refs{/sha}","trees_url":"https://api.github.com/repos/jsha/node/git/trees{/sha}","statuses_url":"https://api.github.com/repos/jsha/node/statuses/{sha}","languages_url":"https://api.github.com/repos/jsha/node/languages","stargazers_url":"https://api.github.com/repos/jsha/node/stargazers","contributors_url":"https://api.github.com/repos/jsha/node/contributors","subscribers_url":"https://api.github.com/repos/jsha/node/subscribers","subscription_url":"https://api.github.com/repos/jsha/node/subscription","commits_url":"https://api.github.com/repos/jsha/node/commits{/sha}","git_commits_url":"https://api.github.com/repos/jsha/node/git/commits{/sha}","comments_url":"https://api.github.com/repos/jsha/node/comments{/number}","issue_comment_url":"https://api.github.com/repos/jsha/node/issues/comments{/number}","contents_url":"https://api.github.com/repos/jsha/node/contents/{+path}","compare_url":"https://api.github.com/repos/jsha/node/compare/{base}...{head}","merges_url":"https://api.github.com/repos/jsha/node/merges","archive_url":"https://api.github.com/repos/jsha/node/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/jsha/node/downloads","issues_url":"https://api.github.com/repos/jsha/node/issues{/number}","pulls_url":"https://api.github.com/repos/jsha/node/pulls{/number}","milestones_url":"https://api.github.com/repos/jsha/node/milestones{/number}","notifications_url":"https://api.github.com/repos/jsha/node/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/jsha/node/labels{/name}","releases_url":"https://api.github.com/repos/jsha/node/releases{/id}","deployments_url":"https://api.github.com/repos/jsha/node/deployments","created_at":"2015-09-26T09:08:37Z","updated_at":"2015-09-26T09:08:57Z","pushed_at":"2016-05-13T17:56:41Z","git_url":"git://github.com/jsha/node.git","ssh_url":"git@github.com:jsha/node.git","clone_url":"https://github.com/jsha/node.git","svn_url":"https://github.com/jsha/node","homepage":"https://nodejs.org","size":189736,"stargazers_count":0,"watchers_count":0,"language":"JavaScript","has_issues":false,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":0,"mirror_url":null,"open_issues_count":0,"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"nodejs:master","ref":"master","sha":"aa34b439095770d0935439718a683b43fbbbf1ad","user":{"login":"nodejs","id":9950313,"avatar_url":"https://avatars.githubusercontent.com/u/9950313?v=3","gravatar_id":"","url":"https://api.github.com/users/nodejs","html_url":"https://github.com/nodejs","followers_url":"https://api.github.com/users/nodejs/followers","following_url":"https://api.github.com/users/nodejs/following{/other_user}","gists_url":"https://api.github.com/users/nodejs/gists{/gist_id}","starred_url":"https://api.github.com/users/nodejs/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/nodejs/subscriptions","organizations_url":"https://api.github.com/users/nodejs/orgs","repos_url":"https://api.github.com/users/nodejs/repos","events_url":"https://api.github.com/users/nodejs/events{/privacy}","received_events_url":"https://api.github.com/users/nodejs/received_events","type":"Organization","site_admin":false},"repo":{"id":27193779,"name":"node","full_name":"nodejs/node","owner":{"login":"nodejs","id":9950313,"avatar_url":"https://avatars.githubusercontent.com/u/9950313?v=3","gravatar_id":"","url":"https://api.github.com/users/nodejs","html_url":"https://github.com/nodejs","followers_url":"https://api.github.com/users/nodejs/followers","following_url":"https://api.github.com/users/nodejs/following{/other_user}","gists_url":"https://api.github.com/users/nodejs/gists{/gist_id}","starred_url":"https://api.github.com/users/nodejs/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/nodejs/subscriptions","organizations_url":"https://api.github.com/users/nodejs/orgs","repos_url":"https://api.github.com/users/nodejs/repos","events_url":"https://api.github.com/users/nodejs/events{/privacy}","received_events_url":"https://api.github.com/users/nodejs/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/nodejs/node","description":"Node.js JavaScript runtime :sparkles::turtle::rocket::sparkles:","fork":false,"url":"https://api.github.com/repos/nodejs/node","forks_url":"https://api.github.com/repos/nodejs/node/forks","keys_url":"https://api.github.com/repos/nodejs/node/keys{/key_id}","collaborators_url":"https://api.github.com/repos/nodejs/node/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/nodejs/node/teams","hooks_url":"https://api.github.com/repos/nodejs/node/hooks","issue_events_url":"https://api.github.com/repos/nodejs/node/issues/events{/number}","events_url":"https://api.github.com/repos/nodejs/node/events","assignees_url":"https://api.github.com/repos/nodejs/node/assignees{/user}","branches_url":"https://api.github.com/repos/nodejs/node/branches{/branch}","tags_url":"https://api.github.com/repos/nodejs/node/tags","blobs_url":"https://api.github.com/repos/nodejs/node/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/nodejs/node/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/nodejs/node/git/refs{/sha}","trees_url":"https://api.github.com/repos/nodejs/node/git/trees{/sha}","statuses_url":"https://api.github.com/repos/nodejs/node/statuses/{sha}","languages_url":"https://api.github.com/repos/nodejs/node/languages","stargazers_url":"https://api.github.com/repos/nodejs/node/stargazers","contributors_url":"https://api.github.com/repos/nodejs/node/contributors","subscribers_url":"https://api.github.com/repos/nodejs/node/subscribers","subscription_url":"https://api.github.com/repos/nodejs/node/subscription","commits_url":"https://api.github.com/repos/nodejs/node/commits{/sha}","git_commits_url":"https://api.github.com/repos/nodejs/node/git/commits{/sha}","comments_url":"https://api.github.com/repos/nodejs/node/comments{/number}","issue_comment_url":"https://api.github.com/repos/nodejs/node/issues/comments{/number}","contents_url":"https://api.github.com/repos/nodejs/node/contents/{+path}","compare_url":"https://api.github.com/repos/nodejs/node/compare/{base}...{head}","merges_url":"https://api.github.com/repos/nodejs/node/merges","archive_url":"https://api.github.com/repos/nodejs/node/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/nodejs/node/downloads","issues_url":"https://api.github.com/repos/nodejs/node/issues{/number}","pulls_url":"https://api.github.com/repos/nodejs/node/pulls{/number}","milestones_url":"https://api.github.com/repos/nodejs/node/milestones{/number}","notifications_url":"https://api.github.com/repos/nodejs/node/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/nodejs/node/labels{/name}","releases_url":"https://api.github.com/repos/nodejs/node/releases{/id}","deployments_url":"https://api.github.com/repos/nodejs/node/deployments","created_at":"2014-11-26T19:57:11Z","updated_at":"2016-05-17T07:19:38Z","pushed_at":"2016-05-17T05:41:18Z","git_url":"git://github.com/nodejs/node.git","ssh_url":"git@github.com:nodejs/node.git","clone_url":"https://github.com/nodejs/node.git","svn_url":"https://github.com/nodejs/node","homepage":"https://nodejs.org","size":266738,"stargazers_count":23223,"watchers_count":23223,"language":"JavaScript","has_issues":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":3293,"mirror_url":null,"open_issues_count":662,"forks":3293,"open_issues":662,"watchers":23223,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/nodejs/node/pulls/3073"},"html":{"href":"https://github.com/nodejs/node/pull/3073"},"issue":{"href":"https://api.github.com/repos/nodejs/node/issues/3073"},"comments":{"href":"https://api.github.com/repos/nodejs/node/issues/3073/comments"},"review_comments":{"href":"https://api.github.com/repos/nodejs/node/pulls/3073/comments"},"review_comment":{"href":"https://api.github.com/repos/nodejs/node/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/nodejs/node/pulls/3073/commits"},"statuses":{"href":"https://api.github.com/repos/nodejs/node/statuses/9fd483ed3588f581a53663bae5059544f799c9aa"}}}}