HmacAlgorithm::memcmp

function memcmp() internally used by PHP, exits as soon as a difference
 * is found in the two buffers. That makes possible of leaking
 * timing information useful to an attacker attempting to iteratively guess
 * the unknown string (e.g. password).
 *
 * @param string $expected Expected string (e.g. generated signature).
 * @param string $actual Actual string (e.g. signature received from user).
 * @throws BitrixMainArgumentTypeException
 * @return bool
 */
protected function compareStrings($expected, $actual)
{
	if (!is_string($expected))
	{
		throw new ArgumentTypeException('expected', 'string');
	}

	if (!is_string($actual))
	{
		throw new ArgumentTypeException('actual', 'string');
	}

	$lenExpected = strlen($expected);
	$lenActual = strlen($actual);

	$status = $lenExpected ^ $lenActual;
	$len = min($lenExpected, $lenActual);
	for ($i = 0; $i < $len; $i++)
	{
		$status |= ord($expected[$i]) ^ ord($actual[$i]);
	}

	return $status === 0;
}