replace byte.Equals with hmac.Equals in order to avoid timing side-channels

crypto/rc4-hmac.go

@@ -2,6 +2,7 @@ package crypto
 
 import (
 	"bytes"
+	"crypto/hmac"
 	"crypto/md5"
 	"hash"
 	"io"
@@ -130,8 +131,5 @@ func (e RC4HMAC) VerifyChecksum(protocolKey, data, chksum []byte, usage uint32)
 	if err != nil {
 		return false
 	}
-	if !bytes.Equal(checksum, chksum) {
-		return false
-	}
-	return true
+	return hmac.Equal(checksum, chksum)
 }

crypto/rfc4757/encryption.go

@@ -2,7 +2,7 @@
 package rfc4757
 
 import (
-	"bytes"
+	"crypto/hmac"
 	"crypto/rand"
 	"crypto/rc4"
 	"errors"
@@ -76,8 +76,5 @@ func DecryptMessage(key, data []byte, usage uint32, export bool, e etype.EType)
 // VerifyIntegrity checks the integrity checksum of the data matches that calculated from the decrypted data.
 func VerifyIntegrity(key, pt, data []byte, e etype.EType) bool {
 	chksum := HMAC(key, pt)
-	if bytes.Equal(chksum, data[:e.GetHMACBitLength()/8]) {
-		return true
-	}
-	return false
+	return hmac.Equal(chksum, data[:e.GetHMACBitLength()/8])
 }

gssapi/WrapToken.go

@@ -2,6 +2,7 @@ package gssapi
 
 import (
 	"bytes"
+	"crypto/hmac"
 	"encoding/binary"
 	"encoding/hex"
 	"errors"
@@ -157,7 +158,7 @@ func (wt *WrapToken) VerifyCheckSum(key types.EncryptionKey, keyUsage uint32) (b
 	if cErr != nil {
 		return false, cErr
 	}
-	if !bytes.Equal(computed, wt.CheckSum) {
+	if !hmac.Equal(computed, wt.CheckSum) {
 		return false, fmt.Errorf(
 			"checksum mismatch. Computed: %s, Contained in token: %s",
 			hex.EncodeToString(computed), hex.EncodeToString(wt.CheckSum))