Skip to content

Add scalar FixedTimeEquals overload#127826

Merged
vcsjones merged 1 commit intodotnet:mainfrom
vcsjones:fixed-time-equals-scalar
May 6, 2026
Merged

Add scalar FixedTimeEquals overload#127826
vcsjones merged 1 commit intodotnet:mainfrom
vcsjones:fixed-time-equals-scalar

Conversation

@vcsjones
Copy link
Copy Markdown
Member

@vcsjones vcsjones commented May 5, 2026

Fixes #127584

Implement the approved CryptographicOperations overload for comparing a span against a scalar byte value in fixed time, and use it for the Windows X25519 all-zero shared secret check.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
@dotnet-policy-service
Copy link
Copy Markdown
Contributor

Tagging subscribers to this area: @bartonjs, @vcsjones, @dotnet/area-system-security
See info in area-owners.md if you want to be subscribed.

Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Adds a new scalar overload for CryptographicOperations.FixedTimeEquals so callers can compare a buffer against a repeated byte value without materializing a second span. In this codebase, that primarily simplifies constant-time zero-buffer checks such as the Windows X25519 shared-secret validation path.

Changes:

  • Added CryptographicOperations.FixedTimeEquals(ReadOnlySpan<byte> source, byte value) to the implementation and ref assembly.
  • Replaced the Windows X25519 all-zero shared-secret check to use the new scalar overload instead of a hard-coded zero span.
  • Expanded FixedTimeEquals tests to cover scalar true/false cases and verify both overloads retain the required method implementation flags.
Show a summary per file
File Description
src/libraries/System.Security.Cryptography/tests/FixedTimeEqualsTests.cs Adds scalar overload coverage and updates the method-attribute reflection test.
src/libraries/System.Security.Cryptography/src/System/Security/Cryptography/X25519DiffieHellmanImplementation.Windows.cs Switches the all-zero shared-secret check to the new scalar overload.
src/libraries/System.Security.Cryptography/src/System/Security/Cryptography/CryptographicOperations.cs Implements and documents the new public scalar overload.
src/libraries/System.Security.Cryptography/ref/System.Security.Cryptography.cs Exposes the new public API in the ref assembly.

Copilot's findings

  • Files reviewed: 4/4 changed files
  • Comments generated: 0

@vcsjones vcsjones enabled auto-merge (squash) May 6, 2026 13:16
@vcsjones
Copy link
Copy Markdown
Member Author

vcsjones commented May 6, 2026

/ba-g failures are unrelated

@vcsjones vcsjones merged commit 2fc23e6 into dotnet:main May 6, 2026
96 of 99 checks passed
@vcsjones vcsjones deleted the fixed-time-equals-scalar branch May 6, 2026 15:06
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[API Proposal]: CryptographicOperations.FixedTimeIsZeros

4 participants