var crypto = require("crypto")
  , path   = require("path")
  , fs     = require("fs")

  , existsSync = fs.existsSync || path.existsSync

  , keysPath = path.join(__dirname, "defaultKeys.json")
  , defaults = existsSync(keysPath)
      ? JSON.parse(fs.readFileSync(keysPath))
      : undefined

function Keygrip(keys) {
  if (!(this instanceof Keygrip)) return new Keygrip(keys)

  if (!keys || !(0 in keys)) {
    if (keys = defaults) console.warn("No keys specified, using defaults instead.")

    else throw "Keys must be provided or default keys must exist."
  }

  function sign(data, key) {
    return crypto
      .createHmac("sha1", key)
      .update(data).digest("base64")
      .replace(/\/|\+|=/g, function(x) {
        return ({ "/": "_", "+": "-", "=": "" })[x]
      })
  }

  this.sign = function(data){ return sign(data, keys[0]) }

  this.verify = function(data, digest) {
    return this.index(data, digest) > -1
  }

  this.index = function(data, digest) {
    for (var i = 0, l = keys.length; i < l; i++) {
      if (digest === sign(data, keys[i])) return i
    }

    return -1
  }
}

Keygrip.sign = Keygrip.verify = Keygrip.index = function() {
  throw "Usage: require('keygrip')(<array-of-keys>)"
}

module.exports = Keygrip

var crypto = require("crypto")
  , path   = require("path")
  , fs     = require("fs")

  , existsSync = fs.existsSync || path.existsSync

  , keysPath = path.join(__dirname, "defaultKeys.json")
  , defaults = existsSync(keysPath)
      ? JSON.parse(fs.readFileSync(keysPath))
      : undefined

function Keygrip(keys) {
  if (!(this instanceof Keygrip)) return new Keygrip(keys)

  if (!keys || !(0 in keys)) {
    if (keys = defaults) console.warn("No keys specified, using defaults instead.")

    else throw "Keys must be provided or default keys must exist."
  }

  function sign(data, key) {
    return crypto
      .createHmac("sha1", key)
      .update(data).digest("base64")
      .replace(/\/|\+|=/g, function(x) {
        return ({ "/": "_", "+": "-", "=": "" })[x]
      })
  }

  this.sign = function(data){ return sign(data, keys[0]) }

  this.verify = function(data, digest) {
    return this.index(data, digest) > -1
  }

  this.index = function(data, digest) {
    for (var i = 0, l = keys.length; i < l; i++) {
      if (constantTimeCompare(digest, sign(data, keys[i]))) return i
    }

    return -1
  }
}

Keygrip.sign = Keygrip.verify = Keygrip.index = function() {
  throw "Usage: require('keygrip')(<array-of-keys>)"
}

//http://codahale.com/a-lesson-in-timing-attacks/
var constantTimeCompare = function(val1, val2){
    if(val1 == null && val2 != null){
        return false;
    } else if(val2 == null && val1 != null){
        return false;
    } else if(val1 == null && val2 == null){
        return true;
    }

    if(val1.length !== val2.length){
        return false;
    }

    var matches = 1;

    for(var i = 0; i < val1.length; i++){
        matches &= (val1.charAt(i) === val2.charAt(i) ? 1 : 0); //Don't short circuit
    }

    return matches === 1;
};

module.exports = Keygrip

Use constant time comparison to check keys to prevent the possibility of a timing attack to brute force a signature