Check the comparisons that must not leak timing

constant_equals was only checked for its answers, on strings that
differ in one byte. Summing the plain differences instead of their
squares passed, which accepts any signature with the same byte sum, and
so did a plain == at the signature or the password check.

0 files changed, 0 insertions, 0 deletions