hmac.compare_digest is constant time whereas == will return as soon as a mismatch is found. The difference in return time can be measured. The key phrase is a T

hmac.compare_digest is constant time whereas == will return as soon as a mismatch is found. The difference in return time can be measured. The key phrase is a Timing Attack[0]. [0]https://en.wikipedia.org/wiki/Timing_attack https://en.wikipedia.org/wiki/Timing_attack