either approach avoids leaking useful information, doesn't it? one does so by guaranteeing identical times. the other by passing the information through a one

either approach avoids leaking useful information, doesn't it? one does so by guaranteeing identical times. the other by passing the information through a one-way function. the link given in the advice you point to includes a fairly detailed discussion / comparison - https://www.isecpartners.com/blog/2011/february/double-hmac-verification.aspx https://www.isecpartners.com/blog/2011/february/double-hmac-...