> What's the difference between a plaintext key and a hash in this context? > The attacker can crack the first byte of the key by trying all 256 possibilities,

> What's the difference between a plaintext key and a hash in this context? > The attacker can crack the first byte of the key by trying all 256 possibilities, and observing which one caused the comparison to take longer. OK as a thought experiment, the algorithm is passed plaintext data A (the input that the hacker is trying to guess) and hashed data B. It hashes A before starting a comparison and then does a naive check, an we have code like- function checkApiKey(inputKey, correctHashedKey) { inputHashedKey=sha256(inputKey) if (inputHashedKey !== correctHashedKey) { throw new Error("wrong key"); } } If we're using a decently secure hash algorithm, for every bit that changes in the input, we will create (indistinguishable from) random changes throughout the output. An attacker on this system can't just continually tweak the first byte of input to figure out when a longer comparison takes place, because there's no guarantee that doing that will ever result in the first byte of the hash matching the first byte of the stored hash. And in theory that doesn't actually give away any information about the full password, because if you've matched byte one, adding the next byte to your guess changes the whole hash in unpredictable ways. Constant time still removes this sort of avenue entirely, but this would seem to confound the attack (or at least make it much harder problem to solve). Happy to be educated otherwise if someone that's actually an expert would like to chime in?