secure_compare.rb

# constant-time comparison algorithm to prevent timing attacks
# (borrowed from devise)
def secure_compare(a, b)
  return false if a.bytesize != b.bytesize
  l = a.unpack "C#{a.bytesize}"

  res = 0
  b.each_byte { |byte| res |= byte ^ l.shift }
  res == 0
end