4 ms·
The Java implementation linked from the article, jBCrypt, http://www.mindrot.org/files/jBCrypt/jBCrypt-0.2-doc/ http://www.mindrot.org/files/jBCrypt/jBCrypt-0.2
by pmjordan 16y ago
The Java implementation linked from the article, jBCrypt, http://www.mindrot.org/files/jBCrypt/jBCrypt-0.2-doc/ http://www.mindrot.org/files/jBCrypt/jBCrypt-0.2-doc/ uses java.lang.String's compareTo() function (lexicographical comparison) to validate the hashes of passwords. Is there cause for concern about this in practice, considering it will probably have varying runtimes for different match lengths? (I realise that running in a JITted VM means I can't predict the assembly language produced anyway)