|
| 1 | +// Flags: --allow_natives_syntax |
| 2 | +'use strict'; |
| 3 | +const common = require('../common'); |
| 4 | +const assert = require('assert'); |
| 5 | + |
| 6 | +if (!common.hasCrypto) { |
| 7 | + common.skip('missing crypto'); |
| 8 | + return; |
| 9 | +} |
| 10 | + |
| 11 | +const crypto = require('crypto'); |
| 12 | + |
| 13 | +assert.strictEqual( |
| 14 | + crypto.timingSafeEqual(Buffer.from('foo'), Buffer.from('foo')), |
| 15 | + true, |
| 16 | + 'should consider equal strings to be equal' |
| 17 | +); |
| 18 | + |
| 19 | +assert.strictEqual( |
| 20 | + crypto.timingSafeEqual(Buffer.from('foo'), Buffer.from('bar')), |
| 21 | + false, |
| 22 | + 'should consider unequal strings to be unequal' |
| 23 | +); |
| 24 | + |
| 25 | +assert.throws(function() { |
| 26 | + crypto.timingSafeEqual(Buffer.from([1, 2, 3]), Buffer.from([1, 2])); |
| 27 | +}, 'should throw when given buffers with different lengths'); |
| 28 | + |
| 29 | +assert.throws(function() { |
| 30 | + crypto.timingSafeEqual('not a buffer', Buffer.from([1, 2])); |
| 31 | +}, 'should throw if the first argument is not a buffer'); |
| 32 | + |
| 33 | +assert.throws(function() { |
| 34 | + crypto.timingSafeEqual(Buffer.from([1, 2]), 'not a buffer'); |
| 35 | +}, 'should throw if the second argument is not a buffer'); |
| 36 | + |
| 37 | +function runBenchmark(compareFunc, bufferA, bufferB, expectedResult) { |
| 38 | + const startTime = process.hrtime(); |
| 39 | + const result = compareFunc(bufferA, bufferB); |
| 40 | + const endTime = process.hrtime(startTime); |
| 41 | + |
| 42 | + // Ensure that the result of the function call gets used, so that it doesn't |
| 43 | + // get discarded due to engine optimizations. |
| 44 | + assert.strictEqual(result, expectedResult); |
| 45 | + return endTime[0] * 1e9 + endTime[1]; |
| 46 | +} |
| 47 | + |
| 48 | +function getTValue(compareFunc) { |
| 49 | + const numTrials = 10000; |
| 50 | + const testBufferSize = 10000; |
| 51 | + // Perform benchmarks to verify that timingSafeEqual is actually timing-safe. |
| 52 | + const bufferA1 = Buffer.alloc(testBufferSize, 'A'); |
| 53 | + const bufferA2 = Buffer.alloc(testBufferSize, 'A'); |
| 54 | + const bufferB = Buffer.alloc(testBufferSize, 'B'); |
| 55 | + const bufferC = Buffer.alloc(testBufferSize, 'C'); |
| 56 | + |
| 57 | + const rawEqualBenches = Array(numTrials); |
| 58 | + const rawUnequalBenches = Array(numTrials); |
| 59 | + |
| 60 | + for (let i = 0; i < numTrials; i++) { |
| 61 | + // First benchmark: comparing two equal buffers |
| 62 | + rawEqualBenches[i] = runBenchmark(compareFunc, bufferA1, bufferA2, true); |
| 63 | + // Second benchmark: comparing two unequal buffers |
| 64 | + rawUnequalBenches[i] = runBenchmark(compareFunc, bufferB, bufferC, false); |
| 65 | + } |
| 66 | + |
| 67 | + const equalBenches = filterOutliers(rawEqualBenches); |
| 68 | + const unequalBenches = filterOutliers(rawUnequalBenches); |
| 69 | + |
| 70 | + // Use a two-sample t-test to determine whether the timing difference between |
| 71 | + // the benchmarks is statistically significant. |
| 72 | + // https://wikipedia.org/wiki/Student%27s_t-test#Independent_two-sample_t-test |
| 73 | + |
| 74 | + const equalMean = mean(equalBenches); |
| 75 | + const unequalMean = mean(unequalBenches); |
| 76 | + |
| 77 | + const equalLen = equalBenches.length; |
| 78 | + const unequalLen = unequalBenches.length; |
| 79 | + |
| 80 | + const combinedStd = combinedStandardDeviation(equalBenches, unequalBenches); |
| 81 | + const standardErr = combinedStd * Math.sqrt(1 / equalLen + 1 / unequalLen); |
| 82 | + |
| 83 | + return (equalMean - unequalMean) / standardErr; |
| 84 | +} |
| 85 | + |
| 86 | +// Returns the mean of an array |
| 87 | +function mean(array) { |
| 88 | + return array.reduce((sum, val) => sum + val, 0) / array.length; |
| 89 | +} |
| 90 | + |
| 91 | +// Returns the sample standard deviation of an array |
| 92 | +function standardDeviation(array) { |
| 93 | + const arrMean = mean(array); |
| 94 | + const total = array.reduce((sum, val) => sum + Math.pow(val - arrMean, 2), 0); |
| 95 | + return Math.sqrt(total / (array.length - 1)); |
| 96 | +} |
| 97 | + |
| 98 | +// Returns the common standard deviation of two arrays |
| 99 | +function combinedStandardDeviation(array1, array2) { |
| 100 | + const sum1 = Math.pow(standardDeviation(array1), 2) * (array1.length - 1); |
| 101 | + const sum2 = Math.pow(standardDeviation(array2), 2) * (array2.length - 1); |
| 102 | + return Math.sqrt((sum1 + sum2) / (array1.length + array2.length - 2)); |
| 103 | +} |
| 104 | + |
| 105 | +// Filter large outliers from an array. A 'large outlier' is a value that is at |
| 106 | +// least 50 times larger than the mean. This prevents the tests from failing |
| 107 | +// due to the standard deviation increase when a function unexpectedly takes |
| 108 | +// a very long time to execute. |
| 109 | +function filterOutliers(array) { |
| 110 | + const arrMean = mean(array); |
| 111 | + return array.filter((value) => value / arrMean < 50); |
| 112 | +} |
| 113 | + |
| 114 | +// Force optimization before starting the benchmark |
| 115 | +runBenchmark(crypto.timingSafeEqual, Buffer.from('A'), Buffer.from('A'), true); |
| 116 | +eval('%OptimizeFunctionOnNextCall(runBenchmark)'); |
| 117 | +runBenchmark(crypto.timingSafeEqual, Buffer.from('A'), Buffer.from('A'), true); |
| 118 | + |
| 119 | +// t_(0.9995, ∞) |
| 120 | +// i.e. If a given comparison function is indeed timing-safe, the t-test result |
| 121 | +// has a 99.9% chance to be below this threshold. Unfortunately, this means that |
| 122 | +// this test will be a bit flakey and will fail 0.1% of the time even if |
| 123 | +// crypto.timingSafeEqual is working properly. |
| 124 | +// t-table ref: http://www.sjsu.edu/faculty/gerstman/StatPrimer/t-table.pdf |
| 125 | +// Note that in reality there are roughly `2 * numTrials - 2` degrees of |
| 126 | +// freedom, not ∞. However, assuming `numTrials` is large, this doesn't |
| 127 | +// significantly affect the threshold. |
| 128 | +const T_THRESHOLD = 3.291; |
| 129 | + |
| 130 | +const t = getTValue(crypto.timingSafeEqual); |
| 131 | +assert( |
| 132 | + Math.abs(t) < T_THRESHOLD, |
| 133 | + `timingSafeEqual should not leak information from its execution time (t=${t})` |
| 134 | +); |
| 135 | + |
| 136 | +// As a sanity check to make sure the statistical tests are working, run the |
| 137 | +// same benchmarks again, this time with an unsafe comparison function. In this |
| 138 | +// case the t-value should be above the threshold. |
| 139 | +const unsafeCompare = (bufA, bufB) => bufA.equals(bufB); |
| 140 | +const t2 = getTValue(unsafeCompare); |
| 141 | +assert( |
| 142 | + Math.abs(t2) > T_THRESHOLD, |
| 143 | + `Buffer#equals should leak information from its execution time (t=${t2})` |
| 144 | +); |
0 commit comments