Switch argument order for hash_equals

[kelunik]

First argument is documented to be the known string, but actually it shouldn't matter, since length information is leaked anyway.

[odino]

hey @kelunik thanks! What do you mean by "length information is leaked anyway"?

[kelunik]

hash_equals is documented to have the first argument always the known string, but this is no longer true. The implementation is symmetric for both arguments. I guess it iterated over the user-provided string before not to leak timing information, but as timing information is impossible to leak here, it has been removed to a symmetric version.

Leaking length information means that an attacker can always guess the length of the token that you compare it to, but that doesn't really matter. If your strings are not equal in length, you'll hit the early return. But as said, length isn't really the secret here.

[kelunik]

Please have a look at PR #58 first.