SEC-1666: Use constant time comparison for sensitive data.

Constant time comparison helps to mitigate timing attacks. See the following link for more information

 * http://rdist.root.org/2010/07/19/exploiting-remote-timing-attacks/
 * http://en.wikipedia.org/wiki/Timing_attack for more information.

crypto/src/test/java/org/springframework/security/crypto/password/StandardPasswordEncoderTests.java

@@ -16,6 +16,12 @@ public class StandardPasswordEncoderTests {
         assertTrue(encoder.matches("password", result));
     }
 
+    @Test
+    public void matchesLengthChecked() {
+        String result = encoder.encode("password");
+        assertFalse(encoder.matches("password", result.substring(0,result.length()-1)));
+    }
+
     @Test
     public void notMatches() {
         String result = encoder.encode("password");