feat(utils): harden constant-time comparison

Ensure comparison covers full input length and add tests for matching and mismatching cases.

Author: LimiNode

hmac_utils.cpp

@@ -6,10 +6,12 @@
 namespace hmac {
 
     bool constant_time_equals(const std::string &a, const std::string &b) {
-        if (a.size() != b.size()) return false;
-        unsigned char diff = 0;
-        for (size_t i = 0; i < a.size(); ++i) {
-            diff |= static_cast<unsigned char>(a[i]) ^ static_cast<unsigned char>(b[i]);
+        size_t max_len = a.size() > b.size() ? a.size() : b.size();
+        unsigned char diff = static_cast<unsigned char>(a.size() ^ b.size());
+        for (size_t i = 0; i < max_len; ++i) {
+            unsigned char ac = i < a.size() ? static_cast<unsigned char>(a[i]) : 0;
+            unsigned char bc = i < b.size() ? static_cast<unsigned char>(b[i]) : 0;
+            diff |= ac ^ bc;
         }
         return diff == 0;
     }

test_all.cpp

@@ -49,6 +49,15 @@ TEST(UtilsTest, ToHex) {
     EXPECT_EQ(hmac::to_hex("012345"), "303132333435");
 }
 
+TEST(UtilsTest, ConstantTimeEqualsMatch) {
+    EXPECT_TRUE(hmac::constant_time_equals("alpha", "alpha"));
+}
+
+TEST(UtilsTest, ConstantTimeEqualsMismatch) {
+    EXPECT_FALSE(hmac::constant_time_equals("alpha", "beta"));
+    EXPECT_FALSE(hmac::constant_time_equals("alpha", "alphabet"));
+}
+
 TEST(HMACTest, SHA256) {
     const std::string key = "12345";
     const std::string input = "grape";