Fix non-constant-time prefix comparison in LegacyFullMac

[LuisCastellanos-dev]

Fix non-constant-time prefix comparison in LegacyFullMac

Closes #75

What

Replace Arrays.equals() with MessageDigest.isEqual() when comparing the
output prefix in LegacyFullMac.verifyMac().

Why

Arrays.equals() short-circuits on the first differing byte. In a context
where an attacker can measure response latency, this allows them to determine
how many bytes of the tag prefix are correct — leaking information about the
key identifier byte by byte.

MessageDigest.isEqual() is the standard constant-time comparison for
byte arrays in Java's security APIs. It always iterates over both arrays
in full, regardless of content.

The ChunkedMacVerificationFromComputation path already uses
MessageDigest.isEqual() for the MAC tag comparison. This fix brings
LegacyFullMac into alignment with that approach for its prefix comparison.

Change

LegacyFullMac.java

Before:
if (!Arrays.equals(identifier, prefix)) {

After:
if (!MessageDigest.isEqual(identifier, prefix)) {

Tests

Added LegacyFullMacTimingSafeTest with three cases:

• Tag with correct first prefix byte but corrupted last prefix byte (TINK)
• Same for CRUNCHY variant
• Tag with all prefix bytes corrupted

Notes

• import java.security.MessageDigest added
• import java.util.Arrays retained (still used for copyOfRange)

[tholenst]

Both "identifier" and "prefix" are already public information, hence Array.equals is fine.

[LuisCastellanos-dev]

Thanks for the clarification, @tholenst — closing this as the fix is already in place.