Function constantTimeEquals

3rdparty/libprocess/src/jwt.cpp:166–178

Implements equality between strings which run in constant time by either comparing the sizes, and thus ignoring their content, or checking the whole content of them, thus avoiding timing attacks when comparing hashes.

// comparing the sizes, and thus ignoring their content, or checking the whole
// content of them, thus avoiding timing attacks when comparing hashes.
bool constantTimeEquals(const string& left, const string& right)
{
  if (left.size() != right.size()) {
    return false;
  }

  unsigned valid = 0;
  for (size_t i = 0; i < left.size(); ++i) {
    valid |= left[i] ^ right[i];
  }

  return valid == 0;
}

} // namespace {