use constant time equality function when comparing hashes
Created originally on Bitbucket by Anonymous
===== //(Imported from Google Code)//
Many frameworks seem to be adopting 'constant time' equality functions when comparing hashes.
This seems to stem from a warning about [[[http://codahale.com/a-lesson-in-timing-attacks/|http://codahale.com/a-lesson-in-timing-attacks/]] hmac timing attacks]. Such attacks aren't relevant for most password hash use-cases, but it's being adopted nevertheless since the cost is minimal, and the security increase is small but non-zero (as well laid out in this [[[https://code.djangoproject.com/ticket/15627|https://code.djangoproject.com/ticket/15627]] Django issue]).
Should probably throw this into the next major passlib release.