Use constant-time comparison
@@ -45,7 +45,7 @@ public synchronized DTLSRequest verifyRequest(byte[] clientID, byte[] data, int
byte[] expectedCookie = cookieMAC.calculateMAC();
resetCookieMAC = false;
- if (Arrays.areEqual(expectedCookie, request.getClientHello().getCookie()))
+ if (Arrays.constantTimeAreEqual(expectedCookie, request.getClientHello().getCookie()))
{
return request;
}
