bloritsch

  def secure_compare(a, b)
    result = a.length ^ b.length
    for i in 0..99 # or some other constant
      result |= a[i].to_i ^ b[i].to_i
    end
    resul...

  def secure_compare(a, b)
    result = a.length ^ b.length
    for i in 0..([a.length, b.length].max - 1)
      result |= a[i].to_i ^ b[i].to_i
    end
    re...

I just thought of something last night. Using the length of the requester provided HMAC to control the loop opens the door for a possible Denial of Service atta...

OK, after reading up on the timing attack, and found out that Ruby 1.9 likes to automatically convert bytes to characters, I found an approach that will always ...