28 ms·
> isMatch = false; That instruction is executed conditionally, you can time it. Maybe eliminate the if completely an do something like this ... for
by madacol 3y ago
> isMatch = false;
That instruction is executed conditionally, you can time it.
Maybe eliminate the if completely an do something like this
...
for (var i = 0; i < inputKey.length; i++)
isMatch = isMatch && (inputKey.charAt(i) !== correctKey.charAt(i)
}
...
- another-dave 3y agoBut if you have an incorrect key, you'll always execute the whole for loop & one write to `isMatch`. I'm assuming the function would take the same amount of time to run regardless for which value of "i" the write occurs at. Wouldn't that then protect the attack vector of enumerating keys and checking the time? As in, the only input that would cause the write to `isMatch` to be skipped would be the correct key, in which case you don't need to brute force the solution.
- ramchip 3y agoBranch prediction and speculative execution can affect that. For instance failing on the first byte could cause more iterations to be thrown away and re-executed than failing on the last byte.
- another-dave 3y agoah cool I understand what you mean now. Thanks for the explanation!