Add verify method to HMAC instances to have a comparison utility that does not leak information thr…

sdk/lib/crypto/crypto.dart

 // Copyright (c) 2012, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 #library('dart:crypto');
 
 #import('dart:math');
 
 #source('crypto_utils.dart');
 #source('hash_utils.dart');
@@ skipping 26 matching lines @@
    * a list of bytes.
    */
   List<int> digest();
 
   /**
    * Returns a new instance of this hash function.
    */
   Hash newInstance();
 
   /**
-   * Block size of the hash in bytes.
+   * Internal block size of the hash in bytes.
+   *
+   * This is exposed for use by the HMAC class which needs to know the
+   * block size for the [Hash] it is using.
    */
   int get blockSize;
 }
 
 /**
  * SHA1 hash function implementation.
  */
 abstract class SHA1 implements Hash {
   factory SHA1() => new _SHA1();
 }
@@ skipping 30 matching lines @@
   /**
    * Add a list of bytes to the message.
    */
   HMAC update(List<int> data);
 
   /**
    * Perform the actual computation and extract the message digest
    * as a list of bytes.
    */
   List<int> digest();
+
+  /**
+   * Verify that the HMAC computed for the data so far matches the
+   * given message digest.
+   *
+   * This method should be used instead of memcmp-style comparisons
+   * to avoid leaking information via timing.
+   *
+   * Throws an exception if the given digest does not have the same
+   * size as the digest computed by this HMAC instance.
+   */
+  bool verify(List<int> digest);
 }
 
 /**
  * Utility methods for working with message digests.
  */
 abstract class CryptoUtils {
   /**
    * Convert a list of bytes (for example a message digest) into a hex
    * string.
    */
@@ skipping 14 matching lines @@
 /**
  * HashExceptions are thrown on invalid use of a Hash
  * object.
  */
 class HashException {
   HashException(String this.message);
   toString() => "HashException: $message";
   String message;
 }