Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

You don't really need to. You can guarantee that the right HMAC and the wrong HMAC both take exactly the same amount of time to compare by using a constant-time algorithm like the one in the article without dealing with non-portable, unreliable timers.

(In some languages—hi Ruby!—you might not even have access to reliable millisecond-resolution timing.)



Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: