prevent timing attacks by using a time-constant comparison algorithm