# Timing-safe memcmp and API parity

DevFeed: [Timing-safe memcmp and API parity](<https://devfeed.tech/articles/timing-safe-memcmp-and-api-parity-36633.md>)

Original publisher: [Read original article](<https://rdist.root.org/2014/06/24/timing-safe-memcmp-and-api-parity/>)

Author: Nate Lawson

Published: 2014-06-24T12:03:33Z

Content type: opinion

Language: en

Sources: [rdist](<https://devfeed.tech/sources/rdist.md>)

Topics: [API](<https://devfeed.tech/topics/api.md>), [C](<https://devfeed.tech/topics/c.md>), [Optimization](<https://devfeed.tech/topics/optimization.md>), [vulnerability](<https://devfeed.tech/topics/vulnerability.md>), [ordering](<https://devfeed.tech/topics/ordering.md>)

Tags: [api](<https://devfeed.tech/tags/api.md>), [assembly](<https://devfeed.tech/tags/assembly.md>), [branch-prediction](<https://devfeed.tech/tags/branch-prediction.md>), [c](<https://devfeed.tech/tags/c.md>), [cache](<https://devfeed.tech/tags/cache.md>), [compiler](<https://devfeed.tech/tags/compiler.md>), [cpu](<https://devfeed.tech/tags/cpu.md>), [developers](<https://devfeed.tech/tags/developers.md>), [optimization](<https://devfeed.tech/tags/optimization.md>), [ordering](<https://devfeed.tech/tags/ordering.md>), [performance](<https://devfeed.tech/tags/performance.md>), [security](<https://devfeed.tech/tags/security.md>), [timing](<https://devfeed.tech/tags/timing.md>)

## AI overview

The article discusses OpenBSD's timing-safe bcmp and memcmp APIs. It supports simpler constant-time equality comparison but questions timing-safe ordered comparison because compiler and CPU behavior may undermine its guarantees and because ordering secret data can indicate larger architectural problems.

## Source excerpt

OpenBSD released a new API with a timing-safe bcmp and memcmp. I strongly agree with their strategy of encouraging developers to adopt "safe" APIs, even at a slight performance loss. The strlcpy/strlcat family of functions they pioneered have been immensely helpful against overflows. Data-independent timing routines are extremely hard to get right, and the farther you are from ... Continue reading Timing-safe memcmp and API parity