From: "Martin Boßlet" <martin.bosslet@...>
Date: 2012-05-29T18:29:38+09:00
Subject: Re: does this leak more than the size of the string via timing side channels

2012/5/29 rooby shoez <lists@ruby-forum.com>:
> But if I use the inject to compare array values in addition to using the
> hashing, will it make it more secure than just using the hashing with
> ==? I imagine it might help to hide the hash data, maybe that could
> theoretically be beneficial if the attacker manages to break the hash
> algorithm.
>

It shouldn't hurt if you do an additional byte-by-byte comparison of the hashes
to hide their value, but being able to break SHA-2 on completely random
input (which a good MAC would provide) would require alien technology,
at least today :)