Add Arrays.constantTimeAreEquals(char[], char[])
@@ -149,6 +149,42 @@ public static boolean constantTimeAreEqual(int len, byte[] a, int aOff, byte[] b
return 0 == d;
}
+ /**
+ * A constant time equals comparison - does not terminate early if
+ * comparison fails. For best results always pass the expected value
+ * as the first parameter.
+ *
+ * @param expected first array
+ * @param supplied second array
+ * @return true if arrays equal, false otherwise.
+ */
+ public static boolean constantTimeAreEqual(
+ char[] expected,
+ char[] supplied) {
+ if (expected == null || supplied == null) {
+ return false;
+ }
+
+ if (expected == supplied) {
+ return true;
+ }
+
+ int len = Math.min(expected.length, supplied.length);
+
+ int nonEqual = expected.length ^ supplied.length;
+
+ // do the char-wise comparison
+ for (int i = 0; i != len; i++) {
+ nonEqual |= (expected[i] ^ supplied[i]);
+ }
+ // If supplied is longer than expected, iterate over rest of supplied with NOPs
+ for (int i = len; i < supplied.length; i++) {
+ nonEqual |= ((byte) supplied[i] ^ (byte) ~supplied[i]);
+ }
+
+ return nonEqual == 0;
+ }
+
public static int compareUnsigned(byte[] a, byte[] b)
{
if (a == b)
