4 ms·
Perhaps another reason to use a fixed time string equality function
by tshadwell 12y ago
Perhaps another reason to use a fixed time string equality function
- yeukhon 12y agoYou mean checking 123 == 1234 actually going through all 4 characters instead of immediate stop?
- mikeash 12y agoI believe it's OK to bail out early if the lengths aren't equal, but otherwise yes, you'd want e.g. 1234 == 1345 to continue to the end even though it's obvious from the second character that they aren't equal.
- bmm6o 12y agoBailing early reveals the information that the lengths are different. In most cases the attacker knows the length of the target string and so this test will never pass. You can probably imagine a scenario where the length isn't known and step 1 is to determine the target length.