For comparisons, the normal “trick” is to & a failure flag for every character in the hashes so you’ll always compare the same number of characters. At the end,

For comparisons, the normal “trick” is to & a failure flag for every character in the hashes so you’ll always compare the same number of characters. At the end, the failure flag is returned. This may cost more time in obvious failure cases, but eliminates timing oracles (assuming comparison and & operations require the same number of cycles regardless of the operands).