ConstantTime (Apache Tomcat 11.0.23 API Documentation)
Description: declaration: package: org.apache.tomcat.util.security, class: ConstantTime

# Class ConstantTime

java.lang.Object
org.apache.tomcat.util.security.ConstantTime

public class ConstantTime extends Object
Utility class for methods that, for security reasons, need to run in - as far as practical - constant time.

- ## Method Summary

  Modifier and Type
  Method
  Description
  `static boolean`
  `equals(byte[] b1, byte[] b2)`
  Implements byte-array equality which always compares all bytes in the array, without stopping early if any bytes do not match.
  `static boolean`
  `equals(String s1, String s2, boolean ignoreCase)`
  Implements String equality which always compares all characters in the string, without stopping early if any characters do not match.
  `static boolean`
  `equals(ByteChunk bc, String s)`
  Implements ByteChunk / String equality which always compares all characters, without stopping early if any characters do not match.

  ### Methods inherited from class Object

  `clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait`

- ## Method Details

  - ### equals

    public static boolean equals(String s1, String s2, boolean ignoreCase)
    Implements String equality which always compares all characters in the string, without stopping early if any characters do not match.

    Note: This implementation was adapted from `MessageDigest.isEqual(byte[], byte[])` which we assume is as optimizer-defeating as possible.

    Parameters:
      `s1` - The first string to compare.
      `s2` - The second string to compare.
      `ignoreCase` - `true` if the strings should be compared without regard to case. Note that "true" here is only guaranteed to work with plain ASCII characters.
    Returns:
      `true` if the strings are equal to each other, `false` otherwise.

  - ### equals

    public static boolean equals(ByteChunk bc, String s)
    Implements ByteChunk / String equality which always compares all characters, without stopping early if any characters do not match.

    Note: This implementation was adapted from `MessageDigest.isEqual(byte[], byte[])` which we assume is as optimizer-defeating as possible.

    Parameters:
      `bc` - The ByteChunk to compare.
      `s` - The string to compare.
    Returns:
      `true` if the strings are equal to each other, `false` otherwise.

  - ### equals

    public static boolean equals(byte[] b1, byte[] b2)
    Implements byte-array equality which always compares all bytes in the array, without stopping early if any bytes do not match.

    Note: Implementation note: this method delegates to `MessageDigest.isEqual(byte[], byte[])` under the assumption that it provides a constant-time comparison of the bytes in the arrays. Java 7+ has such an implementation, but neither the Javadoc nor any specification requires it. Therefore, Tomcat should continue to use this method internally in case the JDK implementation changes so this method can be re-implemented properly.

    Parameters:
      `b1` - The first array to compare.
      `b2` - The second array to compare.
    Returns:
      `true` if the arrays are equal to each other, `false` otherwise.