http://codahale.com/a-lesson-in-timing-attacks/ http://codahale.com/a-lesson-in-timing-attacks/ Suggests 20us over internet, 100ns over lan. Are there more com

http://codahale.com/a-lesson-in-timing-attacks/ http://codahale.com/a-lesson-in-timing-attacks/ Suggests 20us over internet, 100ns over lan. Are there more complexities to comparing HMACs than are mentioned in this article? I.e. anything else to think about other than not short-circuiting your comparisons when bytes don't match? More discussion (including from someone called Nate, presumably the same person tptacek is referring to) at: http://groups.google.com/group/keyczar-discuss/browse_thread/thread/5571eca0948b2a13 http://groups.google.com/group/keyczar-discuss/browse_thread... And a paper which I can't read without paying: http://www.computer.org/portal/web/csdl/doi/10.1109/MSP.2009.165 http://www.computer.org/portal/web/csdl/doi/10.1109/MSP.2009...