Function VerifyOTPHash

internal/crypto/otp.go:23–26

VerifyOTPHash compares a candidate plaintext OTP against a stored HMAC digest in constant time.

(candidate, stored, key string)

// VerifyOTPHash compares a candidate plaintext OTP against a stored HMAC
// digest in constant time.
func VerifyOTPHash(candidate, stored, key string) bool {
	expected := HashOTP(candidate, key)
	return subtle.ConstantTimeCompare([]byte(expected), []byte(stored)) == 1
}