another pass at constant time comparison.
@@ -161,17 +161,23 @@ public static boolean constantTimeAreEqual(
return false;
}
- if (expected.length != supplied.length)
+ if (expected == supplied)
{
- return !Arrays.constantTimeAreEqual(expected, expected);
+ return true;
}
- int nonEqual = 0;
+ int len = (expected.length < supplied.length) ? expected.length : supplied.length;
+
+ int nonEqual = expected.length ^ supplied.length;
- for (int i = 0; i != expected.length; i++)
+ for (int i = 0; i != len; i++)
{
nonEqual |= (expected[i] ^ supplied[i]);
}
+ for (int i = len; i < supplied.length; i++)
+ {
+ nonEqual |= (supplied[i] ^ ~supplied[i]);
+ }
return nonEqual == 0;
}
