Use subtle.ConstantTimeEq for hash length comparison