[OCaml] High Intensity Training Online
docs Do not promise constant-time at the hashing port
The port defines the check; the timing guarantee belongs to the adapter's comparison, not to the port. State that instead of asserting constant-time, which the port cannot guarantee.
lib/app/password_hash.mli
@@ -7,5 +7,6 @@
7
7
(** Salt and hash a new password into a stored verifier. *)
8
8
9
9
val verify : hash:string -> string -> bool
10
Removed:
(** Constant-time check of a candidate password against a stored verifier. *)
10
Added:
(** Check a candidate password against a stored verifier. The adapter supplies
11
Added:
the comparison, so it decides the timing guarantee. *)
11
12
end