progrium/ruby-jwt — pull request #43 by creasty (2014-09-08 17:24:35+00:00)
Title: Needless measures to against timing attack

I guess this secure comparation of two hash values isn't necessary.

According to the comment of Paŭlo Ebermann, he said:

> if the attacker does know neither the used salt nor the stored hash,
> I would guess that a timing of the comparison of calculated and stored hash will not give any information at all,
> since every (even single bit) change of the password input will result in a completely different hash.
> http://security.stackexchange.com/questions/9192/timing-attacks-on-password-hashes

So I removed secure_compare method.