clean up crypto; remove timing attacks