Soenneker.Security.Util 11.0.62

Prefix Reserved
.NET 11.0 This package targets .NET 11.0. The package is compatible with this framework or higher. 
dotnet add package Soenneker.Security.Util --version 11.0.62
                    


                    

                
NuGet\Install-Package Soenneker.Security.Util -Version 11.0.62
This command is intended to be used within the Package Manager Console in Visual Studio, as it uses the NuGet module's version of Install-Package. 
<PackageReference Include="Soenneker.Security.Util" Version="11.0.62" />
For projects that support PackageReference, copy this XML node into the project file to reference the package. 
<PackageVersion Include="Soenneker.Security.Util" Version="11.0.62" />
                    


                            Directory.Packages.props
                        

                    

                
<PackageReference Include="Soenneker.Security.Util" />
                    


                            Project file
For projects that support Central Package Management (CPM), copy this XML node into the solution Directory.Packages.props file to version the package. 
paket add Soenneker.Security.Util --version 11.0.62
                    


                    

                
#r "nuget: Soenneker.Security.Util, 11.0.62"
#r directive can be used in F# Interactive and Polyglot Notebooks. Copy this into the interactive tool or source code of the script to reference the package. 
#:package Soenneker.Security.Util@11.0.62
#:package directive can be used in C# file-based apps starting in .NET 10 preview 4. Copy this into a .cs file before any lines of code to reference the package. 
#addin nuget:?package=Soenneker.Security.Util&version=11.0.62
                    


                            Install as a Cake Addin
                        

                    

                
#tool nuget:?package=Soenneker.Security.Util&version=11.0.62
                    


                            Install as a Cake Tool

alternate text is missing from this package README image alternate text is missing from this package README image alternate text is missing from this package README image alternate text is missing from this package README image

Soenneker.Security.Util

Bounded-work equality checks for secrets represented as UTF-8 bytes or characters.

Installation

dotnet add package Soenneker.Security.Util

Byte comparison

using Soenneker.Security.Util;

bool matches = SecurityUtil.FixedCostEqualsUtf8(
    suppliedSecretUtf8,
    expectedSecretUtf8,
    paddedLength: 128);

The byte overload compares exactly paddedLength bytes of zero-padded temporary storage and includes the original byte lengths in the result. It returns false when either input exceeds the budget or the budget is not positive.

Character comparison

bool matches = SecurityUtil.FixedCostEqualsUtf8(
    suppliedSecret.AsSpan(),
    expectedSecret.AsSpan(),
    paddedLength: 128);

The character overload encodes both spans as UTF-8, includes their encoded lengths in the comparison, and returns false if either encoding exceeds the byte budget. paddedLength is a UTF-8 byte count, not a character count.

Choosing a budget

Use a fixed, trusted budget large enough for every valid value in the credential class you are comparing. Do not derive it from the supplied secret, and do not expose an unbounded caller-controlled value: budgets above 256 bytes rent temporary arrays proportional to the requested size.

The comparison loop performs work based on the fixed budget rather than the location of the first mismatch. Input validation and UTF-8 encoding still depend on input length, so this API should not be described as making the entire surrounding authentication flow constant-time.

Temporary byte buffers are zeroed before return. The input spans are read-only and remain owned by the caller; this utility cannot clear them. Avoid creating immutable secret strings when byte-oriented input is available.

This is an equality primitive, not password hashing. Use a purpose-built password hashing or identity system for user passwords; use fixed-cost equality for already-protected tokens, API keys, signatures, or similar fixed-secret verification where direct equality is appropriate.

Product Compatible and additional computed target framework versions.
.NET net11.0 is compatible. 
Compatible target framework(s)
Included target framework(s) (in package)
Learn more about Target Frameworks and .NET Standard.

  • net11.0

    • No dependencies.

NuGet packages (2)

Showing the top 2 NuGet packages that depend on Soenneker.Security.Util:

Package Downloads
Soenneker.Validators.BasicAuth

A lightweight validation module for validating HTTP Basic Authentication credentials.
Soenneker.Validators.BasicAuth.Functions

A validation module for validating HTTP Basic Authentication credentials in Functions.

GitHub repositories

This package is not used by any popular GitHub repositories.

Version Downloads Last Updated
11.0.62 114 11/11/2026
11.0.61 407 10/27/2026
11.0.60 192 10/26/2026
11.0.58 159 10/26/2026
4.0.57 236 10/25/2026
4.0.56 227 10/14/2026
4.0.55 250 10/14/2026
4.0.49 152 10/13/2026
4.0.48 103 10/12/2026
4.0.47 331 10/11/2026
4.0.46 589 9/24/2026
4.0.45 402 9/15/2026
4.0.44 514 9/12/2026
4.0.43 289 9/8/2026
4.0.42 385 9/7/2026
4.0.41 528 8/30/2026
4.0.40 222 8/29/2026
4.0.39 121 8/29/2026
4.0.38 1,198 8/12/2026
4.0.37 522 7/28/2026
Loading failed

Upgrade .NET 11 release candidates to stable