private boolean matches ( byte [ ] expected , byte [ ] actual ) { if ( expected . length != actual . length ) { return false ; } int result = 0 ; for ( int i = 0 ; i < expected . length ; i ++ ) { result |= expected [ i ] ^ actual [ i ] ; } return result == 0 ; }
Constant time comparison to prevent against timing attacks .