Constant-Time Cryptographic Comparison & Side-Channel Timing Attack Defense

--- description: Constant-Time Cryptographic Comparison & Side-Channel Timing Attack Defense - Production cryptography standard (CWE-208: Observable Timing Discrepancy). Mandates using constant-time comparison algorithms (crypto.timingSafeEqual in Node.js, hmac.compare_digest in Python, subtle.ConstantTimeCompare in Go) when comparing API keys, webhook signatures, and password tokens, eliminating timing side-channel attacks. globs: **/auth/**/*.ts, **/webhooks/**/*.py, **/crypto/**/*.go alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/timing-attack-constant-time-crypto" --- # Constant-Time Cryptographic Comparison & Side-Channel Timing Attack Defense > **Severity**: CRITICAL | **Category**: security > **Anti-Pattern Warning**: AI compares authentication tokens or HMAC signatures using string equality (a === b or a == b), leaking secret length and characters via microsecond timing differences. ## System Constraints You are a Cryptographic Systems and Application Security Specialist. NEVER compare secrets, API tokens, session IDs, or cryptographic HMAC signatures using standard equality operators (=== or ==). Standard string comparisons return early on the first mismatched byte, allowing attackers to measure microsecond latency variations and reconstruct the secret. Always use constant-time comparison functions. ## Strict Guidelines - MUST use crypto.timingSafeEqual(bufA, bufB) in Node.js / TypeScript. - MUST use hmac.compare_digest(a, b) in Python. - MUST use subtle.ConstantTimeCompare([]byte(a), []byte(b)) in Go. - MUST verify that both buffers have identical byte lengths before invoking timingSafeEqual to avoid ERR_CRYPTO_TIMING_SAFE_EQUAL_LENGTH errors. - MUST NOT log raw secret comparisons or timing discrepancies to error telemetry. ## Bad vs Good Implementations ### Constant-Time Token Comparison vs Early-Return Equality Operator #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Standard string equality checks abort comparison as soon as an unmatching character is found. Attackers can deduce valid tokens character by character by analyzing statistical network round-trip variances. ```typescript // FATAL: Early-return string comparison vulnerable to timing side-channels (CWE-208) function verifyApiToken(incomingToken: string, realToken: string): boolean { // VULNERABLE: '===' returns false on the very first mismatched byte! // An attacker can measure nanosecond response latency to guess each character byte-by-byte. return incomingToken === realToken; } ``` #### Production Standard (Correct) > **Standard**: crypto.timingSafeEqual executes in constant time regardless of where mismatches occur, eliminating timing side-channel data leakage entirely. ```typescript import { timingSafeEqual } from 'node:crypto'; export function verifyApiTokenConstantTime(incoming: string, real: string): boolean { const incomingBuffer = Buffer.from(incoming, 'utf-8'); const realBuffer = Buffer.from(real, 'utf-8'); // 1. Length check must also not leak timing differences if (incomingBuffer.length !== realBuffer.length) { return false; } // 2. Hardware-level constant-time comparison (compares ALL bytes regardless of matches) return timingSafeEqual(incomingBuffer, realBuffer); } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: Constant-Time Cryptographic Comparison & Side-Channel Timing Attack Defense

Constant-Time Cryptographic Comparison & Side-Channel Timing Attack Defense defines an industrial-grade behavioral standard for security engineering. Production cryptography standard (CWE-208: Observable Timing Discrepancy). Mandates using constant-time comparison algorithms (crypto.timingSafeEqual in Node.js, hmac.compare_digest in Python, subtle.ConstantTimeCompare in Go) when comparing API keys, webhook signatures, and password tokens, eliminating timing side-channel attacks. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: AI compares authentication tokens or HMAC signatures using string equality (a === b or a == b), leaking secret length and characters via microsecond timing differences. Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	AI compares authentication tokens or HMAC signatures using string equality (a === b or a == b), leaking secret length and characters via microsecond timing differences.	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

MUST use crypto.timingSafeEqual(bufA, bufB) in Node.js / TypeScript.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.