4 ms·

The for loop duration here will vary depending on the length of the string

• umsm 12y ago
  That was a quick copy/paste. But imagine the loop would be the string we know (i.e. the password). Looping through the 10-character pass should be identical every time, regardless of what the user entered.
  • totony 12y ago
    I imagine the strlen() function is not constant-timed, so I'd remove it, but it might work yes (but you'd have to check PHP's source code and have a deep understanding of it to really be sure).
    • mappu 12y ago
      libc `strlen()` is O(n), but PHP strings are binary safe (i.e. http://3v4l.org/47iaP http://3v4l.org/47iaP ) so it must be storing a length as part of the string zval. So PHP strlen should be constant time. +1 for recommending checking the PHP source code to be sure, though
    • TazeTSchnitzel 12y ago
      strlen() in PHP is constant-time O(1), we don't use C strings. (Well, we do, but we store length information and reference count them) See: http://lxr.php.net/xref/PHP_TRUNK/Zend/zend_builtin_functions.c#524 http://lxr.php.net/xref/PHP_TRUNK/Zend/zend_builtin_function...