THE CONSTANT-TIME COMPARE — a dart

CONSTANT-TIME COMPARE never stop early — the equality that leaks no timing

A naive equality check returns the instant it finds a mismatch — and that early exit is a side channel: an attacker who measures how long a password or MAC comparison takes learns how many leading bytes were right, and can forge a secret one byte at a time. The fix is to refuse to hurry: XOR every pair of bytes and OR the differences into an accumulator, always visiting the whole input, then check if the accumulator is zero. Same yes/no answer, but the running time no longer depends on where the first difference is. Security here is a property of the mechanism’s timing, not its output.

THE TECHNIQUE OR of all byte-XORs, no early return — time independent of data

The demo compares two arrays that differ at index 2 (equal answer to a naive check) while visiting all four elements — no early exit: live demo

HISTORY & CREDIT timing-attack defense · Kocher 1996

“Return as soon as you know the answer.” — for secrets, the when is the leak; a safe compare always runs to the end. cited

the leak · early-exit compare returns faster on a longer correct prefix — timing reveals the secret byte by byte.
the fix · acc |= aᵢ ⊕ bᵢ for all i, then acc == 0 — same answer, constant time.
1996 · Paul Kocher — timing attacks on cryptosystems; constant-time code became standard.

An equality test that always runs to the end — the answer unchanged, the timing silenced. side-channel

RECOMMEND FOR I-13 no early exit, on the compiler

On the canonical compiler, the constant-time compare returns not-equal for arrays differing at index 2, and equal for identical arrays — visiting all elements either way:

$ i13 run zd_consttime.i13 # OR of all XOR-diffs, no early exit RUN OK · 235 step(s) · peak stack 9 · call depth 5 eq_xy = 0 -- [1,2,3,4] vs [1,2,9,4]: differ (all 4 visited) eq_xz = 1 -- [1,2,3,4] vs [1,2,3,4]: equal

Recommend as a NULL — the resource axis, inverted. Constant-time compare computes the same equality function as an early-exit compare (i13 agrees: 0 and 1); what differs is timing — a resource. The security property is precisely that this resource (time) is made independent of the data, i.e. a deliberate B40 invariance. Timing is a side channel, not part of the output relation, so this is resource (B40), not a sixth axis. NULL — and a sharp reminder that the corpus counts the output, while security often lives in the cost.