Why Spring Security's BCrypt implementation uses a no-early-return equals method?

Viewed 408

In Spring Security's BCrypt implementation, I came across the following method (source):

static boolean equalsNoEarlyReturn(String a, String b) {
  char[] caa = a.toCharArray();
  char[] cab = b.toCharArray();

  if (caa.length != cab.length) {
    return false;
  }

  byte ret = 0;
  for (int i = 0; i < caa.length; i++) {
    ret |= caa[i] ^ cab[i];
  }
  return ret == 0;
}

Why this no-early-return equals method? What benefit it has over:

static boolean equals(String a, String b) {
  char[] caa = a.toCharArray();
  char[] cab = b.toCharArray();

  if (caa.length != cab.length) {
    return false;
  }

  for (int i = 0; i < caa.length; i++) {
    if (caa[i] != cab[i]) {
      return false;
    }
  }
  return true;
}

Or even:

return a.equals(b)

?

Is it because of a security point of view?

2 Answers
Related