oscerd opened a new pull request, #24397: URL: https://github.com/apache/camel/pull/24397
## Backport of #24375 Cherry-pick of #24375 onto `camel-4.14.x` (for the 4.14.8 fix version). **Original PR:** #24375 — CAMEL-23766: camel-crypto - use constant-time comparison for HMAC verification in HMACAccumulator **Original author:** @oscerd **Target branch:** `camel-4.14.x` ### Original description `HMACAccumulator.validate()` compared the expected and actual MAC byte-by-byte with an early-exit loop, leaking how many leading bytes matched via timing. Uses `java.security.MessageDigest.isEqual()` for a constant-time comparison — the standard practice for MAC/signature verification. Added a test for the mismatch case. Verified on the maintenance branch: cherry-pick applied cleanly (no conflicts) and `HMACAccumulatorTest` (9 tests) passes on `camel-4.14.x`. --- _Claude Code on behalf of Andrea Cosentino_ 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
