Timing-safe comparison
A timing-safe comparison checks every byte of two secrets regardless of where they first differ.
Why it matters
A plain equality check returns early, leaking the length of the matching prefix to anyone who can measure response time.
How it is measured
Send many requests with wrong and correct-prefix tokens and confirm the response time distributions overlap.
Checks that involve timing-safe comparison
Related terms
Questions
What is timing-safe comparison?
A timing-safe comparison checks every byte of two secrets regardless of where they first differ.
Why does timing-safe comparison matter?
A plain equality check returns early, leaking the length of the matching prefix to anyone who can measure response time.
How is timing-safe comparison measured?
Send many requests with wrong and correct-prefix tokens and confirm the response time distributions overlap.