From 67ec4ea1a89b095635df4995e54233313397bab5 Mon Sep 17 00:00:00 2001
From: Dolf Schimmel <dolfschimmel@gmail.com>
Date: Tue, 10 Apr 2018 15:50:57 +0200
Subject: [PATCH] Use constant-time compare when comparing hashes

---
 hash.go | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/hash.go b/hash.go
index 6e10d1e..f80f360 100644
--- a/hash.go
+++ b/hash.go
@@ -16,6 +16,7 @@ import (
 	"bytes"
 	"crypto/md5"
 	"crypto/rand"
+	"crypto/subtle"
 	"errors"
 	"hash"
 	"strings"
@@ -51,7 +52,7 @@ func (h *Hash) Check(pw, pwhash []byte) bool {
 	//if generated[0] == 42 {
 	//	generated = ?crypt?(password, hash)
 	//}
-	return bytes.Equal(generated, pwhash)
+	return 1 == subtle.ConstantTimeCompare(generated, pwhash)
 }
 
 func (h *Hash) crypt(pw, pwhash []byte) ([]byte, error) {