note about constant_time_strcmp and lengths

1 files changed, 2 insertions, 0 deletions

diff --git a/svr-authpasswd.c b/svr-authpasswd.c
index 7a5a121..0153a53 100644
--- a/svr-authpasswd.c
+++ b/svr-authpasswd.c
@@ -33,6 +33,8 @@
 
 #ifdef ENABLE_SVR_PASSWORD_AUTH
 
+/* not constant time when strings are differing lengths. 
+ string content isn't leaked, and crypt hashes are predictable length. */
 static int constant_time_strcmp(const char* a, const char* b) {
 	size_t la = strlen(a);
 	size_t lb = strlen(b);