Re: [RFC] Timing attack safe string comparison function

> I'd suggest str_equals_constant_time(), or maybe streq_constant_time(). > That name is a bit long for my tastes, though. streq_const_time()? Is calling it "str_equals" -- and backing it up with docs and blog posts saying "now use this, instead of strcmp, in authentication sections" -- really that bad? Hardcoding it as resisting one particular attack and that alone seems like a recipe for later confusion. I get we don't want to call it "secure," but what if we add resistance to some other vector, and that measure ends up having to be constantly reiterated because the name is so narrowly targeted? -- S.