Use compare_digest in Python when comparing hex digests

[starpogi]

Doing a == comparison for hex digests could lead to timing attack vulnerabilities. By using Python's compare_digest, it would do a constant-time check by using byte operations. A timing attack on that would only reveal the length of the hashes, and not the values.

More here: https://codahale.com/a-lesson-in-timing-attacks/

• Ruby and PHP sample codes have to be updated too. I just don't know if there is a built-in library that does constant-time comparison correctly in those languages.

[starpogi]

Adding @dideler. Turns out this issue was raised last year.
#133

[dideler]

LGTM

[pirogoeth]

Thanks!