> I'd suggest str_equals_constant_time(), or maybe streq_constant_time().
> That name is a bit long for my tastes, though. streq_const_time()?
Is calling it "str_equals" -- and backing it up with docs and blog
posts saying "now use this, instead of strcmp, in authentication
sections" -- really that bad?
Hardcoding it as resisting one particular attack and that alone seems
like a recipe for later confusion. I get we don't want to call it
"secure," but what if we add resistance to some other vector, and that
measure ends up having to be constantly reiterated because the name is
so narrowly targeted?
-- S.