Is this constant-time comparison secure?
Are there any problems with this constant-time comparison scheme?

One obvious issue is that it'll claim the strings &quot;AB&quot; and &quot;BA&quot; are the same; during the first character, it'll see 'A'-'B' = -1, for the second character, it'll see 'B'-'A' = 1; those two sum to 0.
On the other hand, that's actually fairly close to the standard way to do constant-time compare of equal strings, but instead of summing the differences, we bit-wise or them, as in:
total_difference = 0;
for (i=0; i&lt;len_strings; i++) {
    int this_difference = a[i] - b[i];
    total_difference = total_difference | this_difference;
          /* | is the bit-wise or operator */
}
if (total_difference == 0) {
    /* The strings are the same */
}

The idea here is that the 'or' operation can set bits in total_difference, but never clear them.  Hence, the only way total_difference is 0 at the end is if in every iteration, this_difference was always 0, that that happens if each character of string a was the same as the character in string b.
Often, you'll see this_difference being computed by the bitwise-xor rather than subtraction; the algorithm works the same either way.