https://nalar.dev/tags/cryptography/ Recent content in Cryptography on Nalar Hugo en-us Wed, 02 Sep 2026 00:00:00 +0700 https://nalar.dev/constant-time-comparison-for-authentication-tags-and-secret-values/ Wed, 02 Sep 2026 00:00:00 +0700 https://nalar.dev/constant-time-comparison-for-authentication-tags-and-secret-values/ <p>Security-sensitive verification often ends with a simple question: does an untrusted value equal the value the server expected? For ordinary application data, a normal equality operator is appropriate. For authentication tags and some secret values, however, an equality operation that stops at the first mismatch can expose information through execution time.</p> <p>Timing-safe comparison APIs reduce that risk by avoiding content-dependent short-circuit behavior. They are small tools, but using them correctly requires more than replacing one equality operator.</p>