Module security 

Small security helpers: secure random tokens and constant-time comparison

use ullun::security::{constant_time_eq, random_token};

let token = random_token(16).unwrap();          // 128 bits as 32 hex characters
assert_eq!(token.len(), 32);
assert!(constant_time_eq(token.as_bytes(), token.as_bytes()));

Functions

constant_time_eq

Compare two byte strings without returning early on the first difference, so the time taken does not reveal how much of a secret was guessed right. Different lengths compare unequal (the length itself is not hidden).

random_alphanumeric

Random string of len characters from [A-Za-z0-9], uniformly distributed (rejection sampling). Handy for short public ids; for secrets prefer random_token.

random_bytes

len bytes from the operating system’s CSPRNG

random_token

Unguessable token: bytes random bytes as lowercase hex (2 * bytes characters). Use at least 16 bytes for session ids and secrets.