6 ms·
You don't really need to. You can guarantee that the right HMAC and the wrong HMAC both take exactly the same amount of time to compare by using a constant-time
by codahale 17y ago
You don't really need to. You can guarantee that the right HMAC and the wrong HMAC both take exactly the same amount of time to compare by using a constant-time algorithm like the one in the article without dealing with non-portable, unreliable timers.
(In some languages—hi Ruby!—you might not even have access to reliable millisecond-resolution timing.)