Module secret_eq 

Constant-time comparison for secrets presented by a caller.

== on strings returns at the first differing byte, so how long a rejection takes tells a caller how many leading bytes of its guess were right. Every check of a caller-supplied secret against the real one (srv’s auth key and LAN key, the CEF host’s IPC token, a re-registering host’s token, a webhook verify token) goes through secret_eq instead.

The length is not hidden: a length mismatch returns early. Every secret compared here has a fixed, public length (UUIDs, fixed-size tokens), so the length reveals nothing.

Functions

secret_eq

True when supplied equals expected, in time that depends only on the length, never on where the first difference is.