secure_equals 0.1 → 0.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: f9883242630ffc2552eb1859d0a0b869f218237b
-  data.tar.gz: 0222f297a7683a1927b92241e7fde4de2c9618f4
+  metadata.gz: 5927c8fe3e0da7b11844ee3499546c021eaccacb
+  data.tar.gz: 42aabdfe4e13be7dac50c564be5e4d9d20cd4cc3
 SHA512:
-  metadata.gz: 0ba9b81d792b35adcabbe6163debddf1f8107b11c62b5c12d60cba6d4feab8577ae08a15aaea9bfe692712a5fce9d1d8ad84ecb5c2888a616646381ffdad3700
-  data.tar.gz: e66e06d162ac9d9983533330ea9d9e77d873bbbc4f9e63144dedfd5d196eaf02720a3c7dce13dceacd78618a8a48424731caac22959995ede2ccc63ffc60c9e7
+  metadata.gz: dbc5ff2de9dd038988519bbb8658d2fd02c9566f2e9e8af36f2e29dfc1ec19feec77c7856123ce870a28392375542a009171c5de691ad5cdfc1e1cff188c9575
+  data.tar.gz: 27b845041fc275b854eaf2b9d7f33e88df7ea42750fd348a0d69b4e4b23251345e811816b2e3ef724330cc8f5aaf9f40dc28d5699bce11c70f7a17b4e72880ba

data/.gitignore

@@ -0,0 +1 @@
+*.gem

data/lib/secure_equals.rb

@@ -9,6 +9,7 @@ module SecureEquals
   # @return [Boolean] Are the strings the same?
   #
   def self.equal?(mine, theirs)
+    return false if mine.nil? || theirs.nil?
     mine = mine.to_str
     theirs = theirs.to_str
     return false unless mine.length == theirs.length

data/secure_equals.gemspec

@@ -1,6 +1,6 @@
 Gem::Specification.new do |s|
   s.name = "secure_equals"
-  s.version = "0.1"
+  s.version = "0.2"
   s.platform = Gem::Platform::RUBY
   s.author = "Conrad Irwin"
   s.email = "conrad.irwin@gmail.com"

data/test/timing_attack.rb

@@ -42,39 +42,37 @@ class Box
 
   class Secure < Box
     def guess(str)
-      SecureEquals.same? @secret, str
+      SecureEquals.equal? @secret, str
     end
   end
 end
 
 def brute_force(box, trials)
   scores = []
-  1.times do
-    guess = '0' * 32
-    (0..32).each do |pos|
-      max = 0
-      result = nil
-      this_time = guess.dup
-      'abcdef0123456789'.each_char do |letter|
-        this_time[pos] = letter
-        time = Hitimes::Interval.measure do
-          trials.times{ box.guess this_time }
-        end
-        if time > max
-          max = time
-          result = letter
-        end
+  guess = '0' * 32
+  (0..32).each do |pos|
+    max = 0
+    result = nil
+    this_time = guess.dup
+    'abcdef0123456789'.each_char do |letter|
+      this_time[pos] = letter
+      time = Hitimes::Interval.measure do
+        trials.times{ box.guess this_time }
+      end
+      if time > max
+        max = time
+        result = letter
       end
-      guess[pos] = result
     end
-    scores << box.score(guess)
+    guess[pos] = result
   end
+  scores << box.score(guess)
 
-  puts "average: #{scores.inject(&:+) / scores.size}"
+  puts "#{box.class} average: #{scores.inject(&:+) / scores.size}"
 end
 
 10.times do
   brute_force Box::Weak.new, 1000
-  brute_force Box::Standard.new, 100000
-  brute_force Box::Secure.new, 1000000
+  brute_force Box::Standard.new, 1000
+  brute_force Box::Secure.new, 1000
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: secure_equals
 version: !ruby/object:Gem::Version
-  version: '0.1'
+  version: '0.2'
 platform: ruby
 authors:
 - Conrad Irwin
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2013-11-11 00:00:00.000000000 Z
+date: 2013-12-11 00:00:00.000000000 Z
 dependencies: []
 description: Constant time equality (also known as time insensitive equality) lets
   you compare user-provided strings with secrets in a way that does not leak data
@@ -18,6 +18,7 @@ executables: []
 extensions: []
 extra_rdoc_files: []
 files:
+- .gitignore
 - README.md
 - lib/secure_equals.rb
 - secure_equals.gemspec