note 126285 deleted from function.hash-equals by cmb

Note Submitter: DimeCadmium ---- The code that examplehash is STILL not timing-attack-proof on the length, as PHP will do an implicit bounds check when you attempt to index the user-input-string. However, the polyfills which he calls incorrect are in fact correct polyfills. The problematic behavior he observes (a length oracle) does in fact exist, *however it also exists in the built-in function which they are polyfilling* as is clear from even a cursory read of the documentation on which examplehash was commenting. Tests on the first parameter ($known_string, which he calls $secret) are NOT problematic as the first parameter is trusted information - and that parameter determines the execution time of the function anyway. (Telling the user how long it takes to process the number of characters in THEIR string, which they know the length of, is ALSO a problem, which is what examplehash's code does. Telling the user how long it takes to process the number of characters in YOUR string, which they do NOT know the length of, is NOT a problem.)