cybersecurity · beginner · ~15 min

Which compare is timing-safe?

Identify the timing-safe comparison strategy.

Challenge

Identify which comparison strategy is safe to use on secrets like MACs and tokens.

Task

Implement int is_timing_safe(const char *method) that returns 1 for the timing-safe strategy and 0 for the leaky one.

Input

  • method: a NUL-terminated strategy name the grader passes — either "xor-accumulate" or "early-return-memcmp".

Output

Returns int: 1 for "xor-accumulate", 0 for "early-return-memcmp".

Example

is_timing_safe("xor-accumulate")        ->   1
is_timing_safe("early-return-memcmp")   ->   0

Edge cases

  • Only the accumulate-without-early-return method is timing-safe.

Input format

A NUL-terminated strategy name method.

Output format

An int: 1 for "xor-accumulate", else 0.

Constraints

Only "xor-accumulate" is timing-safe.

Starter code

#include <string.h>

int is_timing_safe(const char *method) {
    /* TODO */
    return 0;
}

Solve this exercise in the browser editor — compile and run against the test harness, no setup required.