feat(kes): Use constant-time comparison for KES public key

[arepala-uml]

1. Updated KES public key verification to subtle.ConstantTimeCompare for consistency with VRF

Closes #1575

---

Summary by cubic

Replaces bytes.Equal with crypto/subtle’s ConstantTimeCompare for KES public key verification in kes to prevent timing leaks and align with VRF. Closes #1575.

^{Written for commit 5ac7647. Summary will update on new commits.}

Summary by CodeRabbit

• Bug Fixes
  • Enhanced security of cryptographic verification operations to improve robustness against certain attack vectors.

[coderabbitai]

📝 Walkthrough

Walkthrough

The change modifies the cryptographic key comparison logic in the KES verification function. Specifically, it replaces the standard byte slice equality check with a constant-time comparison function. The imports were updated to remove the bytes package and add the crypto/subtle package. The verification logic flow and behavior remain unchanged, with the comparison now performed against the HashPair result. No public API changes were made.

🚥 Pre-merge checks | ✅ 4

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately summarizes the main change: replacing bytes.Equal with constant-time comparison for KES public key verification.
Linked Issues check	✅ Passed	The PR successfully implements all coding requirements from issue #1575: replaced bytes.Equal with crypto/subtle.ConstantTimeCompare at the specified location and added the necessary import.
Out of Scope Changes check	✅ Passed	All changes are directly related to the linked issue requirements; only the KES public key comparison logic was modified with appropriate import adjustments.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch kes_pub_key_comapre

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[cubic-dev-ai]

No issues found across 1 file