constant-time-pbkdf2-verify

Answer

The system builds three layers from scratch atop raw SHA-256:

Layer 1 — HMAC-SHA256 (RFC 2104)

HMAC transforms a key into two padded variants (ipad, opad) and computes two nested SHA-256 hashes:

HMAC(K, m) = SHA256( (K' ⊕ opad) || SHA256( (K' ⊕ ipad) || m ) )

where K' is the key padded or hashed to the 64-byte block size.

Layer 2 — PBKDF2 (RFC 2898)

PBKDF2 iteratively applies HMAC-SHA256 as a pseudorandom function. For each output block i:

U₁   = PRF(Password, Salt || INT(i))
Uⱼ   = PRF(Password, Uⱼ₋₁)        for j = 2..c
Tᵢ   = U₁ ⊕ U₂ ⊕ ... ⊕ U_c

Blocks are concatenated and truncated to the desired key length.

Layer 3 — Constant-Time Comparison

The comparison function: 1. Determines maxLen = max(len(a), len(b)) 2. Iterates exactly maxLen times — no early exit 3. For each index, reads aByte and bByte (0 if out-of-bounds) and XORs them into an accumulator via |= 4. Returns accumulator === 0 — a single comparison at the end

Same instruction path for every input — zero branching on data values.

const crypto = require('crypto');

function sha256(data) {
  return crypto.createHash('sha256').update(data).digest();
}

const BLOCK_SIZE = 64, HASH_LEN = 32;

function hmacSha256(key, message) {
  let k = Buffer.isBuffer(key) ? Buffer.from(key) : Buffer.from(key);
  if (k.length > BLOCK_SIZE) k = sha256(k);
  const paddedKey = Buffer.alloc(BLOCK_SIZE, 0);
  k.copy(paddedKey);
  const ipad = Buffer.alloc(BLOCK_SIZE);
  const opad = Buffer.alloc(BLOCK_SIZE);
  for (let i = 0; i < BLOCK_SIZE; i++) {
    ipad[i] = paddedKey[i] ^ 0x36;
    opad[i] = paddedKey[i] ^ 0x5c;
  }
  const innerHash = sha256(Buffer.concat([ipad, Buffer.isBuffer(message) ? message : Buffer.from(message)]));
  return sha256(Buffer.concat([opad, innerHash]));
}

function pbkdf2HmacSha256(password, salt, iterations, dkLen) {
  const saltBuf = Buffer.isBuffer(salt) ? salt : Buffer.from(salt);
  const passBuf = Buffer.isBuffer(password) ? password : Buffer.from(password);
  const numBlocks = Math.ceil(dkLen / HASH_LEN);
  const derived = Buffer.alloc(numBlocks * HASH_LEN);
  for (let blockIndex = 1; blockIndex <= numBlocks; blockIndex++) {
    const blockIndexBE = Buffer.alloc(4);
    blockIndexBE.writeUInt32BE(blockIndex);
    let u = hmacSha256(passBuf, Buffer.concat([saltBuf, blockIndexBE]));
    const t = Buffer.from(u);
    for (let j = 2; j <= iterations; j++) {
      u = hmacSha256(passBuf, u);
      for (let k = 0; k < HASH_LEN; k++) t[k] ^= u[k];
    }
    t.copy(derived, (blockIndex - 1) * HASH_LEN);
  }
  return derived.subarray(0, dkLen);
}

function constantTimeEqual(a, b) {
  if (!Buffer.isBuffer(a)) a = Buffer.from(a);
  if (!Buffer.isBuffer(b)) b = Buffer.from(b);
  const maxLen = a.length > b.length ? a.length : b.length;
  let result = 0;
  for (let i = 0; i < maxLen; i++) {
    const aByte = i < a.length ? a[i] : 0;
    const bByte = i < b.length ? b[i] : 0;
    result |= aByte ^ bByte;
  }
  return result === 0;
}

function verify(candidate, storedHash, salt, iterations) {
  const candidateHash = pbkdf2HmacSha256(candidate, salt, iterations, storedHash.length);
  return constantTimeEqual(candidateHash, storedHash);
}