Use cryptography for signature comparison

1 files changed, 2 insertions, 1 deletions

diff --git a/openid/association.py b/openid/association.py
index de607f4..ca063bd 100644
--- a/openid/association.py
+++ b/openid/association.py
@@ -28,6 +28,7 @@ from __future__ import unicode_literals
 import time
 
 import six
+from cryptography.hazmat.primitives.constant_time import bytes_eq
 
 from openid import cryptutil, kvform, oidutil
 from openid.message import OPENID_NS
@@ -513,7 +514,7 @@ class Association(object):
         if not message_sig:
             raise ValueError("%s has no sig." % (message,))
         calculated_sig = self.getMessageSignature(message)
-        return cryptutil.const_eq(calculated_sig, message_sig)
+        return bytes_eq(calculated_sig.encode('utf-8'), message_sig.encode('utf-8'))
 
     def _makePairs(self, message):
         signed = message.getArg(OPENID_NS, 'signed')