Preventing Timing Attacks on String Comparison with Double HMAC Strategy (2015)

Neat idea! Especially on jitted platforms where the jit is likely to introduce a timing side channel.

Using the timingsafe_memcmp C function would be faster and safer.

so hash(input) == hash(secret) ?