In Spring Security's BCrypt implementation, I came across the following method (source):
static boolean equalsNoEarlyReturn(String a, String b) {
char[] caa = a.toCharArray();
char[] cab = b.toCharArray();
if (caa.length != cab.length) {
return false;
}
byte ret = 0;
for (int i = 0; i < caa.length; i++) {
ret |= caa[i] ^ cab[i];
}
return ret == 0;
}
Why this no-early-return equals method? What benefit it has over:
static boolean equals(String a, String b) {
char[] caa = a.toCharArray();
char[] cab = b.toCharArray();
if (caa.length != cab.length) {
return false;
}
for (int i = 0; i < caa.length; i++) {
if (caa[i] != cab[i]) {
return false;
}
}
return true;
}
Or even:
return a.equals(b)
?
Is it because of a security point of view?