Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Perhaps another reason to use a fixed time string equality function


You mean checking 123 == 1234 actually going through all 4 characters instead of immediate stop?


I believe it's OK to bail out early if the lengths aren't equal, but otherwise yes, you'd want e.g. 1234 == 1345 to continue to the end even though it's obvious from the second character that they aren't equal.


Bailing early reveals the information that the lengths are different. In most cases the attacker knows the length of the target string and so this test will never pass. You can probably imagine a scenario where the length isn't known and step 1 is to determine the target length.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: