- constant-time-string=? A Bprocedure
Compares two strings for equality without leaking, via execution time, the position of the first differing character. hotp-verify and totp-verify use this internally to compare a submitted code against each candidate; exported since it is generically useful for comparing any other secret-derived string (e.g. backup/recovery codes).