# tsscmp

> Timing safe string compare using double HMAC

Latest version **1.0.6** (published 2018-07-31) · MIT license · 0 weekly downloads

## Install

```sh
npm install tsscmp
pnpm add tsscmp
yarn add tsscmp
bun add tsscmp
```

## Health

**Score 23/100 (F)** — status: abandoned.

Positive: has types package; no vulnerabilities; high quality score.

Warnings: low downloads; no esm support.

Negative: abandoned; low maintenance score.

## Facts

| | |
|---|---|
| Version | 1.0.6 |
| Published | 2018-07-31 |
| First published | 2016-05-11 |
| Weekly downloads | 0 |
| License | MIT |
| TypeScript types | separate (@types/tsscmp) |
| Module format | CommonJS |
| Node | >=0.6.x |
| Dependencies | 0 |
| Unpacked size | 8.2 KB |
| Known vulnerabilities | 0 |
| Install scripts | no |
| GitHub stars | 88 |
| Author | suryagh |
| Maintainers | suryagh |
| Keywords | timing safe string compare, double hmac string compare, safe string compare, hmac |

## Links

- npm: https://www.npmjs.com/package/tsscmp
- Repository: https://github.com/suryagh/tsscmp
- Homepage: https://github.com/suryagh/tsscmp#readme
- Issues: https://github.com/suryagh/tsscmp/issues
- npm.io page: https://npm.io/package/tsscmp

## Alternatives

- [@mce/gif](https://npm.io/package/@mce/gif.md) — 2.6K weekly downloads
- [cleanse](https://npm.io/package/cleanse.md) — 173 weekly downloads
- [str](https://npm.io/package/str.md) — 127 weekly downloads
- [naming](https://npm.io/package/naming.md) — 95 weekly downloads
- [tap-telco-api](https://npm.io/package/tap-telco-api.md) — 19 weekly downloads

## Recent versions

- 1.0.6 (latest) — 2018-07-31
- 1.0.5 — 2016-05-26
- 1.0.4 — 2016-05-24
- 1.0.2 — 2016-05-22
- 1.0.1 — 2016-05-12
- 1.0.0 — 2016-05-11

## README

# Timing safe string compare using double HMAC

[![Node.js Version](https://img.shields.io/node/v/tsscmp.svg?style=flat-square)](https://nodejs.org/en/download)
[![npm](https://img.shields.io/npm/v/tsscmp.svg?style=flat-square)](https://npmjs.org/package/tsscmp)
[![NPM Downloads](https://img.shields.io/npm/dm/tsscmp.svg?style=flat-square)](https://npmjs.org/package/tsscmp)
[![Build Status](https://img.shields.io/travis/suryagh/tsscmp/master.svg?style=flat-square)](https://travis-ci.org/suryagh/tsscmp)
[![Build Status](https://img.shields.io/appveyor/ci/suryagh/tsscmp/master.svg?style=flat-square&label=windows)](https://ci.appveyor.com/project/suryagh/tsscmp)
[![Dependency Status](http://img.shields.io/david/suryagh/tsscmp.svg?style=flat-square)](https://david-dm.org/suryagh/tsscmp)
[![npm-license](http://img.shields.io/npm/l/tsscmp.svg?style=flat-square)](LICENSE)


Prevents [timing attacks](http://codahale.com/a-lesson-in-timing-attacks/) using Brad Hill's
[Double HMAC pattern](https://www.nccgroup.trust/us/about-us/newsroom-and-events/blog/2011/february/double-hmac-verification/)
to perform secure string comparison. Double HMAC avoids the timing atacks by blinding the
timing channel using random time per attempt comparison against iterative brute force attacks.


## Install

```
npm install tsscmp
```
## Why
To compare secret values like **authentication tokens**, **passwords** or
**capability urls** so that timing information is not
leaked to the attacker.

## Example

```js
var timingSafeCompare = require('tsscmp');

var sessionToken = '127e6fbfe24a750e72930c';
var givenToken = '127e6fbfe24a750e72930c';

if (timingSafeCompare(sessionToken, givenToken)) {
  console.log('good token');
} else {
  console.log('bad token');
}
```
##License: 
[MIT](LICENSE)

**Credits to:**  [@jsha](https://github.com/jsha) |
[@bnoordhuis](https://github.com/bnoordhuis) |
[@suryagh](https://github.com/suryagh) |

---
_Source: https://npm.io/package/tsscmp · Machine-readable twin of the npm.io package page. Health data is recomputed on every publish._