hash_equals()

hash_equals() — Timing attack safe string comparison.

hash_equals() — Checks whether two strings are equal without leaking information about the contents of known_string via the execution time.

This function can be used to mitigate timing attacks. Performing a regular comparison with === will take more or less time to execute depending on whether the two values are different or not and at which position the first difference can be found, thus leaking information about the contents of the secret known_string.

Inputs: known_string: The known string that must be kept secret. user_string: The user-supplied string to compare against.

Returns: Returns true when the two strings are equal, false otherwise.