Compare tokens in constant time

Challenge

Implement int ct_token_match(const char *a, const char *b) that compares two NUL-terminated tokens in constant time (with respect to their content). Return 1 if equal, 0 otherwise.

Constant time matters when you compare against secrets (HMACs, password hashes, API tokens) — a timing-leaky compare lets an attacker brute-force the secret one byte at a time.

Starter code

#include <stddef.h>

int ct_token_match(const char *a, const char *b) {
    /* TODO */
    return 0;
}