Address 2FA PR feedback

Author: DJAndries

datastore/password_states.go

@@ -13,9 +13,6 @@ import (
 const (
 	NormalStateExpiration = 30 * time.Second
 	TwoFAStateExpiration  = 5 * time.Minute
-
-	// "Compile-time assertion" to ensure that the 2FA expiration time is greater
-	_ = uint64(TwoFAStateExpiration - NormalStateExpiration)
 )
 
 // InterimPasswordState represents the state of an OPAQUE Authenticated Key Exchange or Registration operation

util/util.go

@@ -4,6 +4,7 @@ import (
 	"bytes"
 	"context"
 	"crypto/rand"
+	"crypto/subtle"
 	"encoding/base64"
 	"encoding/json"
 	"fmt"
@@ -98,7 +99,7 @@ func VerifyRecoveryKeyHash(recoveryKey string, storedHash []byte) bool {
 
 	computedHash := generateRecoveryKeyHash(recoveryKey, salt)
 
-	return bytes.Equal(computedHash, expectedHash)
+	return subtle.ConstantTimeCompare(computedHash, expectedHash) == 1
 }
 
 func ExtractAuthToken(r *http.Request) (string, error) {