Always Use Constant-Time Comparison for Verification of MACs

When verifying the MAC for a message, always use a constant-time function when comparing the MAC to the expected value. Common implementations of value comparison will abort on the first mismatching byte. Under most conditions this allows attackers to launch timing attacks against your code to guess the correct MAC for a message.

Using a constant-time function like CRYPTO_memcmp(...) from OpenSSL, sodium_memcmp(...) from libSodium or the dedicated verify() function of the MAC implementation by your crypto library will usually be the easiest way to achieve this.