Use fixed time comparison for hmac