Update constant-time hash equality

Cargo.toml

@@ -23,7 +23,7 @@ neon = []
 # --no-default-features, the only way to use the SIMD implementations in this
 # crate is to enable the corresponding instruction sets statically for the
 # entire build, with e.g. RUSTFLAGS="-C target-cpu=native".
-std = []
+std = ["subtle/std"]
 
 # The `rayon` feature (disabled by default, but enabled for docs.rs) adds the
 # `update_rayon` and (in combination with `mmap` below) `update_mmap_rayon`
@@ -97,12 +97,12 @@ features = ["mmap", "rayon", "serde", "zeroize"]
 [dependencies]
 arrayref = "0.3.5"
 arrayvec = { version = "0.7.4", default-features = false }
-constant_time_eq = "0.3.0"
 cfg-if = "1.0.0"
 digest = { version = "0.10.1", features = [ "mac" ], optional = true }
 memmap2 = { version = "0.9", optional = true }
 rayon-core = { version = "1.12.1", optional = true }
 serde = { version = "1.0", default-features = false, features = ["derive"], optional = true }
+subtle = { version = "2.6", default-features = false }
 zeroize = { version = "1", default-features = false, optional = true }
 
 [dev-dependencies]

src/lib.rs

@@ -138,6 +138,7 @@ use arrayvec::{ArrayString, ArrayVec};
 use core::cmp;
 use core::fmt;
 use platform::{Platform, MAX_SIMD_DEGREE, MAX_SIMD_DEGREE_OR_2};
+use subtle::ConstantTimeEq;
 #[cfg(feature = "zeroize")]
 use zeroize::Zeroize;
 
@@ -315,51 +316,33 @@ impl Zeroize for Hash {
     }
 }
 
-// A proper implementation of constant time equality is tricky, and we get it from the
-// constant_time_eq crate instead of rolling our own. However, that crate isn't compatible with
-// Miri, so we roll our own just for that.
-#[cfg(miri)]
-fn constant_time_eq_miri(a: &[u8], b: &[u8]) -> bool {
-    if a.len() != b.len() {
-        return false;
+impl ConstantTimeEq for Hash {
+    fn ct_eq(&self, other: &Self) -> subtle::Choice {
+        self.0.ct_eq(&other.0)
     }
-    let mut x = 0;
-    for i in 0..a.len() {
-        x |= a[i] ^ b[i];
-    }
-    x == 0
 }
 
 /// This implementation is constant-time.
 impl PartialEq for Hash {
     #[inline]
     fn eq(&self, other: &Hash) -> bool {
-        #[cfg(miri)]
-        return constant_time_eq_miri(&self.0, &other.0);
-        #[cfg(not(miri))]
-        constant_time_eq::constant_time_eq_32(&self.0, &other.0)
+        self.ct_eq(other).into()
     }
 }
 
 /// This implementation is constant-time.
 impl PartialEq<[u8; OUT_LEN]> for Hash {
     #[inline]
     fn eq(&self, other: &[u8; OUT_LEN]) -> bool {
-        #[cfg(miri)]
-        return constant_time_eq_miri(&self.0, other);
-        #[cfg(not(miri))]
-        constant_time_eq::constant_time_eq_32(&self.0, other)
+        self.0.ct_eq(other).into()
     }
 }
 
 /// This implementation is constant-time if the target is 32 bytes long.
 impl PartialEq<[u8]> for Hash {
     #[inline]
     fn eq(&self, other: &[u8]) -> bool {
-        #[cfg(miri)]
-        return constant_time_eq_miri(&self.0, other);
-        #[cfg(not(miri))]
-        constant_time_eq::constant_time_eq(&self.0, other)
+        self.0.ct_eq(other).into()
     }
 }