Constant Time Compare

ConstantTimeCompare answers a deceptively loaded question: "are these two byte strings equal?" - but it answers it in a way that doesn't leak how much of them matched. The naive way to compare two strings is to check byte-by-byte and bail at the first mismatch, and that's exactly the kind of fast-exit a timing attack exploits: the more prefix that matches, the longer the comparison takes, and an attacker can measure that. This node uses a constant-time comparison (cryptography's bytes_eq) where the runtime is the same no matter how many leading bytes match - so nothing about the secret leaks through timing.

For most ARG and puzzle work, this is a "nice to have it done right" node rather than a daily driver. Where it genuinely earns its place is any "did the player submit the correct hash/token?" check. The pack has a whole verify family (ConcatKDF, HMAC) that already returns booleans, but when you're comparing raw bytes directly - say, checking a submitted digest against a known-good one - you want this node and not a hand-rolled comparison. It's the difference between "compares correctly" and "compares correctly and doesn't whisper secrets while doing it."

How it works

Two inputs, both BYTESLIKE with forceInput (so wire them from bytes sources - ByteslikeEncode, a hash node, a keygen). The node calls cryptography.hazmat.primitives.constant_time.bytes_eq(a, b), which does the comparison with a fixed, data-independent runtime, and returns True if the bytes are identical and False otherwise. The tooltip mentions the inputs "in hexadecimal," which is really just a hint about what you'll typically be feeding it - hashes and keys read best as hex once decoded, but any bytes work.

The inputs that matter

• a - first byte string.
• b - second byte string. Same order doesn't matter; equality is symmetric.

Output: is_equal, a boolean.

Installing it

Part of the ComfyUI ARG Toolkit pack. Install via ComfyUI Manager (search "ComfyUI ARG Toolkit") or:

cd ComfyUI/custom_nodes
git clone https://github.com/AzelusLightvale/ComfyUI-ARG-Toolkit

Restart ComfyUI. It runs on the pack's cryptography dependency (along with secretpy, stegano, invisible-watermark, reedsolo, and transitive torch/opencv-python). No models, no API keys.

Gotchas

A couple of practical notes. First, the inputs must be actual bytes - if a wire won't connect, run the text through ByteslikeEncode first, and read the boolean with a node like BooleanOutputter to see it as a string. Second, don't overthink the threat model: constant-time comparison is a defense-in-depth habit, not a magic shield - it protects against a specific timing attack that mostly matters when the thing you're comparing is a secret held by a remote party. In a single-user ARG graph it's belt-and-suspenders, but it's the right habit, and it costs nothing to use. And as ever with this pack, the author is upfront about the testing being hobby-grade, so treat "it returned False" as "they're not equal" rather than a bug hunt.