Make OpenSSL::HMAC#== compare in constant time instead of returning false

2 files changed, 14 insertions, 0 deletions

diff --git a/lib/openssl.rb b/lib/openssl.rb
index ec143bc7..be296955 100644
--- a/lib/openssl.rb
+++ b/lib/openssl.rb
@@ -17,6 +17,7 @@ require_relative 'openssl/pkey'
 require_relative 'openssl/cipher'
 require_relative 'openssl/config'
 require_relative 'openssl/digest'
+require_relative 'openssl/hmac'
 require_relative 'openssl/x509'
 require_relative 'openssl/ssl'
 require_relative 'openssl/pkcs5'
diff --git a/lib/openssl/hmac.rb b/lib/openssl/hmac.rb
new file mode 100644
index 00000000..3d442761
--- /dev/null
+++ b/lib/openssl/hmac.rb
@@ -0,0 +1,13 @@
+# frozen_string_literal: true
+
+module OpenSSL
+  class HMAC
+    # Securely compare with another HMAC instance in constant time.
+    def ==(other)
+      return false unless HMAC === other
+      return false unless self.digest.bytesize == other.digest.bytesize
+
+      OpenSSL.fixed_length_secure_compare(self.digest, other.digest)
+    end
+  end
+end