Constant-Time Cryptographic Signature Validation via subtle.ConstantTimeCompare

package main
 
import (
	"crypto/hmac"
	"crypto/sha256"
	"crypto/subtle"
	"errors"
	"fmt"
)
 
var ErrInvalidMAC = errors.New("invalid message authentication code")
 
func VerifyHMAC(message, messageMAC, key []byte) error {
	mac := hmac.New(sha256.New, key)
	mac.Write(message)
	expectedMAC := mac.Sum(nil)
	if subtle.ConstantTimeCompare(messageMAC, expectedMAC) != 1 {
		return ErrInvalidMAC
	}
	return nil
}
 
func main() {
	key := []byte("secret-signing-key")
	msg := []byte("payload-to-verify")
	mac := hmac.New(sha256.New, key)
	mac.Write(msg)
	validMAC := mac.Sum(nil)
 
	if err := VerifyHMAC(msg, validMAC, key); err != nil {
		fmt.Println("Verification failed:", err)
	} else {
		fmt.Println("Verification succeeded!")
	}
}