The documentation for PHP’s hash_equals()
(a string comparison function which is safe from timing attacks) says,
It is important to provide the user-supplied string as the second parameter, rather than the first.
Why is this?
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this communityThe documentation for PHP’s hash_equals()
(a string comparison function which is safe from timing attacks) says,
It is important to provide the user-supplied string as the second parameter, rather than the first.
Why is this?