Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

PartialEq support #14

Closed
gleb-chipiga opened this issue Apr 24, 2022 · 8 comments
Closed

PartialEq support #14

gleb-chipiga opened this issue Apr 24, 2022 · 8 comments
Assignees
Labels
question Further information is requested

Comments

@gleb-chipiga
Copy link

For my task, I need support for the PartialEq trait. Is it possible to implement the PartialEq trait for TOTP?

@constantoine
Copy link
Owner

Hi! How would you implement it? Do you need to check for same secret? Or just same configuration (digits, period-length, period skew, algo)

@constantoine constantoine added the question Further information is requested label Apr 24, 2022
@gleb-chipiga
Copy link
Author

I mean you can make changes to the totp-rs code.

#[derive(Debug, Clone, PartialEq)]
struct TOTP {
   ...
}

@constantoine
Copy link
Owner

constantoine commented Apr 24, 2022

Seing issue #13 I should probably make sure the token comparison be done in constant time

Since you're just thinking of deriving PartialEq, which is basically checking for every fields equality, I'll implement it but with constant time token comparison

@gleb-chipiga
Copy link
Author

This feature request is irrelevant to issue #13. I need the PartialEq trait in order to use TOTP in an API that requires it. PartialEq has no effect on checking the token.

@constantoine
Copy link
Owner

It as an effect on comparing the secret* sorry this was a typo. I'm working on it

@constantoine constantoine self-assigned this Apr 24, 2022
@gleb-chipiga
Copy link
Author

Thanks!

@gleb-chipiga
Copy link
Author

The eq method is not used to validate user input, so constant time comparison is not required in my humble opinion.

@constantoine
Copy link
Owner

I'm not sure how other people want to use this, so I preferred to err on the side of caution if there's use cases I haven't thought of. But yes, it should normally not be used to validate user input

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
question Further information is requested
Projects
None yet
Development

No branches or pull requests

2 participants