3 ms·
>crypto/ecdsa PublicKey.Equal and PrivateKey.Equal now execute in constant time. Glad to see this pushed. We went to look how Go was handling constant time co
by Zamicol 3y ago
>crypto/ecdsa PublicKey.Equal and PrivateKey.Equal now execute in constant time.
Glad to see this pushed. We went to look how Go was handling constant time comparisons and noticed it was not. This is not considered a serious security issue, as
attacker controlled private key attacks are generally considered out of scope, but it's still nice for the library to be safe. (See https://github.com/golang/go/issues/53849 https://github.com/golang/go/issues/53849)