比较SHA256或Argon2哈希时是否需要担心定时攻击？

Question

我已经实现了用于密码哈希的Argon2哈希算法。我担心我的代码可能会受到定时攻击。

public static boolean login(String mailId, String password) {
    List<UserBean> userList = findByMailId(mailId);

    if (userList == null || userList.isEmpty()) {
        LOGGER.info("user not found");
        return false;
    } else {
        UserBean user = userList.get(0);
        if (PasswordEncoder.matches(password.toCharArray(),
                user.getPassword())) {
            LOGGER.info("password matched");
            SessionUtils.setUserId("" + user.getId());
            SessionUtils.setRole(user.getRole());
            return true;
        } else {
            LOGGER.warn("Password incorrect for : " + user.getEmail());
            return false;
        }
}

如果未找到用户，则响应时间少于成功时间。

PasswordEncoder.class

public class PasswordEncoder {

    private static final Argon2 ARGON2 = Argon2Factory.create();

    private static final int MEMORY = 65536;
    private static final long MAX_MILLI_SECS = 1000;
    private static final int PARALLELISM = 4;
    private static final int ITERATIONS = Argon2Helper.findIterations(ARGON2,
        MAX_MILLI_SECS, MEMORY, PARALLELISM);

    public static String encode(char[] rawPassword) {
        try {
            return ARGON2.hash(ITERATIONS, MEMORY, PARALLELISM, rawPassword);
        } finally {
            ARGON2.wipeArray(rawPassword);
        }
    }

    public static boolean matches(char[] rawPassword, String encodedPassword) {
        try {
            return ARGON2.verify(encodedPassword, rawPassword);
        } finally {
            ARGON2.wipeArray(rawPassword);
        }
    }
}