password_verifyは本当にタイミングセーフなのか？ - Qiita

<?php $username = 'ユーザ名'; $password = 'パスワード'; $hashes = [ 'mpyw' => '$2y$10$p3v4KlSFqx11/84YF2xTJu4h5hQKhwsH5/X5bqoVgkY./.vFxf3HS', ]; $result = isset($hashes[$username]) && password_verify($password, $hashes[$username]); <?php for ($i = 0; $i < 25; ++$i) { $hash = '$2y$10$' . str_repeat('A', $i + 1); $sum = 0.0; for ($j = 0; $j < 30; ++$j) { $start = microtime(true); password_verify('a', $hash);