Timing attack fix

[Vlix]

Added in the constEq anywhere hashes are being compared.

Also cleaned up tests, since with low rounds we can just run 100 on the property tests.

[maralorn]

I am very much not a security auditor. But yes this looks fine to me.

[Vlix]

@maralorn Of course, but just checking that I've adjusted it at the correct location where you found the issue.

[Vlix]

So it builds and addresses the issue, shall I just merge and upload later today?

[cdepillabout]

@Vlix Yes, please do!

Also, you may want to deprecate version 2.0.0.0 and 2.0.0.1 using the Hackage UI so that people know not to use it.

[Vlix]

@cdepillabout because it doesn't have the constEq? By that logic all of the previous versions would have to be deprecated.

[cdepillabout]

@Vlix

By that logic all of the previous versions would have to be deprecated.

I'd be fine with that as well.

---

Although thinking more critically about this, I guess it depends on how big of a problem this is.

Are people likely to have accounts compromised because of not using a constant-time equals? If so, then we should deprecate. If not, then it is probably not a problem, and we don't have to deprecate old versions.