src/Server.php
private function validateChallenge(
        ChallengeProvider $from,
        ChallengeProvider $to
    ): bool {
        // Note: strictly speaking, this shouldn't even be targetable as
        // a timing attack. However, this opts to be proactive, and also
        // ensures that no weird PHP-isms in string handling cause mismatched
        // values to validate.
        if (!hash_equals($from->getChallenge(), $to->getChallenge())) {
            throw new SE(SE::CHALLENGE_MISMATCH);
        }
        // TOOD: generate and compare timestamps
        return true;
    }
private function validateChallenge(
        ChallengeProvider $from,
        ChallengeProvider $to
    ): bool {
        // Note: strictly speaking, this shouldn't even be targetable as
        // a timing attack. However, this opts to be proactive, and also
        // ensures that no weird PHP-isms in string handling cause mismatched
        // values to validate.
        if (!hash_equals($from->getChallenge(), $to->getChallenge())) {
            throw new SE(SE::CHALLENGE_MISMATCH);
        }
        // TOOD: generate and compare timestamps
        return true;
    }
private function validateChallenge ( ChallengeProvider $ from , ChallengeProvider $ to ) : bool { // Note: strictly speaking, this shouldn't even be targetable as // a timing attack. However, this opts to be proactive, and also // ensures that no weird PHP-isms in string handling cause mismatched // values to validate. if ( ! hash_equals ( $ from -> getChallenge ( ) , $ to -> getChallenge ( ) ) ) { throw new SE ( SE :: CHALLENGE_MISMATCH ) ; } // TOOD: generate and compare timestamps return true ; }
Compares the Challenge value from a known source against the
user-provided value. A mismatch will throw a SE. Future
versions may also enforce a timing window.

@param ChallengeProvider $from source of known challenge
@param ChallengeProvider $to user-provided value
@return true on success
@throws SE on failure
Compares the Challenge value from a known source against the user - provided value . A mismatch will throw a SE . Future versions may also enforce a timing window .