constantTimeEquals static method

Future<bool> constantTimeEquals(Uint8List left, Uint8List right)

Compares equal-length inputs using Rust's constant-time equality primitive.

Different public lengths return false without comparing contents. This API does not claim to hide input lengths or prove physical timing behavior.

Implementation

static Future<bool> constantTimeEquals(
  Uint8List left,
  Uint8List right,
) async {
  if (left.length != right.length) return false;

  return Isolate.run(() {
    final allocationLength = left.isEmpty ? 1 : left.length;
    final leftPointer = calloc<ffi.UnsignedChar>(allocationLength);
    final rightPointer = calloc<ffi.UnsignedChar>(allocationLength);
    final outputPointer = calloc<ffi.UnsignedChar>();
    leftPointer.cast<ffi.Uint8>().asTypedList(left.length).setAll(0, left);
    rightPointer.cast<ffi.Uint8>().asTypedList(right.length).setAll(0, right);

    try {
      final status = bindings.ffr_crypto_constant_time_equals(
        leftPointer,
        left.length,
        rightPointer,
        right.length,
        outputPointer,
      );
      checkStatus(status, 'Constant-time byte comparison');
      return outputPointer.value == 1;
    } finally {
      calloc.free(leftPointer);
      calloc.free(rightPointer);
      calloc.free(outputPointer);
    }
  });
}