The documentation for PHP’s
hash_equals() (a string comparison function which is safe from timing attacks) says,
It is important to provide the user-supplied string as the second parameter, rather than the first.
Why is this?
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community