title: How could HMAC comparison ever not be constant-time in Python?
body: <p>Python has a method specifically for comparing HMAC to prevent timing attacks: <a href="https://docs.python.org/3.7/library/hmac.html#hmac.compare_digest" rel="nofollow noreferrer">https://docs.python.org/3.7/library/hmac.html#hmac.compare_digest</a></p>
  
  <p>And I read about timing attacks here: <a href="https://security.stackexchange.com/questions/74547/timing-attack-against-hmac-in-authenticated-encryption">https://security.stackexchange.com/questions/74547/timing-attack-against-hmac-in-authenticated-encryption</a></p>
  
  <p>My question is, how could it possibly ever not be constant-time? It would be necessary to calculate the actual HMAC in order to compare it, and it's not like you could calculate the digest 1 character at a time, right? At the end, it would just be a simple string comparison, which is 2 orders of magnitude faster than the actual HMAC calculation in my tests. So where exactly is the attack surface here? Could someone please give an example of exactly where the actual vulnerability is if I don't use <code>hmac.compare_digest()</code>?</p>