Re: Time Invariant String Comparison

[Coda Highland <chighland@...>]

On Thu, Jan 16, 2014 at 5:01 AM, Oliver Kroth <oliver.kroth@nec-i.de> wrote:
> Why not use hashed passwords, which is a better idea anyway as this takes a
> length independent time, and you may store the credentials in a safe way?

This is the best solution to the problem. The hashing function has
fixed-length output making the comparison immune to timing attacks,
and its own execution time is based only on the length of the input
and leaks no information about the real password.

/s/ Adam