Zend Framework » \Zend\Crypt\Utils

Methods
Compare two strings to avoid timing attacks
```
compareStrings()
```

Tools for cryptography

Methods

Compare two strings to avoid timing attacks

compareStrings(string $expected, string $actual) : bool

C function memcmp() internally used by PHP, exits as soon as a difference is found in the two buffers. That makes possible of leaking timing information useful to an attacker attempting to iteratively guess the unknown string (e.g. password). The length will leak.

Parameters

$expected

string

$actual

string

Returns

bool