Module: ActiveSupport::SecurityUtils

Relationships & Source Files
Defined in:	activesupport/lib/active_support/security_utils.rb

Class Method Summary

.secure_compare(a, b) mod_func

Constant time string comparison.

Class Method Details

.secure_compare(a, b) (mod_func)

Constant time string comparison.

The values compared should be of fixed length, such as strings that have already been processed by HMAC. This should not be used on variable length plaintext strings because it could leak length info via timing attacks.

[ GitHub ]

# File 'activesupport/lib/active_support/security_utils.rb', line 11


def secure_compare(a, b)
  return false unless a.bytesize == b.bytesize

  l = a.unpack "C#{a.bytesize}"

  res = 0
  b.each_byte { |byte| res |= byte ^ l.shift }
  res == 0
end