Struct ConstantTimeOps 

pub struct ConstantTimeOps;

Constant-time comparison utilities for security tokens Uses subtle crate to ensure comparisons take the same time regardless of where differences occur

Implementations

impl ConstantTimeOps

pub fn compare(expected: &[u8], actual: &[u8]) -> bool

Compare two byte slices in constant time

Returns true if equal, false otherwise. Time is independent of where the difference occurs, preventing timing attacks.

Arguments

• expected - The expected (correct/known) value
• actual - The actual (untrusted) value from the user/attacker

Examples

let stored_token = b"secret_token_value";
let user_token = b"user_provided_token";
assert!(!ConstantTimeOps::compare(stored_token, user_token));

pub fn compare_str(expected: &str, actual: &str) -> bool

Compare two strings in constant time

Converts strings to bytes and performs constant-time comparison. Useful for comparing JWT tokens, session tokens, or other string-based secrets.

Arguments

• expected - The expected (correct/known) string value
• actual - The actual (untrusted) string value from the user/attacker

pub fn compare_len_safe(expected: &[u8], actual: &[u8]) -> bool

Compare two slices with different lengths in constant time

If lengths differ, still compares as much as possible to avoid leaking length information through timing.

pub fn compare_jwt(expected: &str, actual: &str) -> bool

Compare JWT tokens in constant time Handles the common case of JWT with header.payload.signature format

pub fn compare_session_token(expected: &str, actual: &str) -> bool

Compare session tokens in constant time Handles session_id:signature format

pub fn compare_csrf_token(expected: &str, actual: &str) -> bool

Compare CSRF tokens in constant time

pub fn compare_hmac(expected: &[u8], actual: &[u8]) -> bool

Compare HMAC signatures in constant time Used for verifying webhook signatures and other HMAC-based authenticity

pub fn compare_refresh_token(expected: &str, actual: &str) -> bool

Compare refresh tokens in constant time

pub fn compare_auth_code(expected: &str, actual: &str) -> bool

Compare authorization codes in constant time (used in OAuth flows)

pub fn compare_pkce_verifier(expected: &str, actual: &str) -> bool

Compare PKCE code verifier in constant time

pub fn compare_state_token(expected: &str, actual: &str) -> bool

Compare state tokens in constant time (CSRF protection in OAuth)