TryValidateChallengeResponse at:

https://github.com/rahvee/CBcrypt/blob/master/CBcrypt/CBcryp...

... appears to have a straightforward, helpfully inlined timeable comparison of challenge responses.

I don't understand what this package is accomplishing. The description leads off talking about the grave privacy implications of storing scrypt password hashes. But then it stores what is in effect an scrypt password hash on the server.