I was thinking about constant-time comparison and how it differs from "==", when I thought of a simple way that's could be constant-time. Being a beginner in cryptography, I'd like to know if my method is secure. This method is probably insecure, but I'd like to know where it's weak. It's really simple.
- Take the two strings to compare, convert them each to a list of numbers (0-255)
totalDifference = 0
- Take the first number from the first list and subtract it from the first number in the second list. Take this difference and add it to
- Do 4. for each character/number in both list.
totalDifferenceis 0 after going through each number, then both strings are equal.
[1,3,5,9,7,8] -[1,3,5,5,7,8] -------------- 0,0,0,4,0,0 0+0+0+4+0+0!=0, so strings not equal
Are there any problems with this constant-time comparison scheme?