hash_equals benchmark

bench.php

<?php
/**
 * Constant-time comparision length leak benchmark.
 * Inspirated by https://gist.github.com/yohgaki/ede544f290c6cf9fa90d
 *
 * @author Kévin Dunglas
 */

$knownSize = 1024;
$userShortSize = 512;
$userLongSize = 2048;

$iterations = 1000;

$i = 0;
while ($i < 10) {
    $known = file_get_contents('/dev/urandom', 0, NULL, -1, $knownSize);
    $userShort = file_get_contents('/dev/urandom', 0, NULL, -1, $userShortSize);
    $userLong = file_get_contents('/dev/urandom', 0, NULL, -1, $userLongSize);

    benchmark($known, $knownSize, $userShort, $userShortSize, $iterations);
    benchmark($known, $knownSize, $known, $knownSize, $iterations);
    benchmark($known, $knownSize, $userLong, $userLongSize, $iterations);

    $i++;
}

function benchmark($known, $knownSize, $user, $userSize, $iterations) {
    $n = 0;
    $start = microtime(TRUE);
    while($n < $iterations) {
        hash_equals($known, $user);
        $n++;
    }
    
    $end = microtime(TRUE) - $start;
    printf('User size: %d       Known size: %d  Elapsed: %f     Iterations: %d'.PHP_EOL, $userSize, $knownSize, $end, $iterations);
}