title: Cryptography .NET, Avoiding Timing Attack
body: <p>I was browsing crackstation.net website and came across this code which was commented as following:</p>
  
  <blockquote>
    <p>Compares two byte arrays in length-constant time. This comparison method is used so that password hashes cannot be extracted from on-line systems using a timing attack and then attacked off-line.</p>
  </blockquote>
  
  <pre><code> private static bool SlowEquals(byte[] a, byte[] b)
      {
          uint diff = (uint)a.Length ^ (uint)b.Length;
          for (int i = 0; i &lt; a.Length &amp;&amp; i &lt; b.Length; i++)
              diff |= (uint)(a[i] ^ b[i]);
          return diff == 0;
      }
  </code></pre>
  
  <p>Can anyone please explain how does this function actual works, why do we need to convert the length to an unsigned integer and how this method avoids a timing attack? What does the line <code>diff |= (uint)(a[i] ^ b[i]);</code> do?</p>