From: Chris Duncan <chris@zoso.dev>
Date: Fri, 8 Aug 2025 19:35:54 +0000 (-0700)
Subject: Verify seed in constant time.
X-Git-Tag: v0.10.5~43^2~4
X-Git-Url: https://git.codecow.com/?a=commitdiff_plain;h=40428861e7a4060a8757f0637217dd333a6e528f;p=libnemo.git

Verify seed in constant time.
---

diff --git a/src/lib/safe.ts b/src/lib/safe.ts
index a0f55cc..8a97124 100644
--- a/src/lib/safe.ts
+++ b/src/lib/safe.ts
@@ -279,23 +279,16 @@ export class Safe {
 			}
 			let isVerified = false
 			if (seed != null) {
-				if (seed.byteLength === this.#seed.byteLength) {
-					const userSeed = new Uint8Array(seed)
-					const thisSeed = new Uint8Array(this.#seed)
-					for (let i = 0; i < seed.byteLength; i++) {
-						if (userSeed[i] === thisSeed[i]) {
-							isVerified = true
-						} else {
-							isVerified = false
-							break
-						}
-					}
+				let diff = 0
+				const userSeed = new Uint8Array(seed)
+				const thisSeed = new Uint8Array(this.#seed)
+				for (let i = 0; i < seed.byteLength; i++) {
+					diff |= userSeed[i] ^ thisSeed[i]
 				}
+				isVerified = diff === 0
 			}
-			if (mnemonicPhrase != null) {
-				if (mnemonicPhrase === this.#mnemonic) {
-					isVerified = true
-				}
+			if (mnemonicPhrase != null && mnemonicPhrase === this.#mnemonic) {
+				isVerified = true
 			}
 			return { isVerified }
 		} catch (err) {