You may want to read this:
http://www.cs.rice.edu/~dwallach/pub/crosby-timing2009.pdf
Adding jitter will not defeat timing attacks unless the jitter is dependent on the input, like blinded RSA.
http://www.cs.rice.edu/~dwallach/pub/crosby-timing2009.pdf
Adding jitter will not defeat timing attacks unless the jitter is dependent on the input, like blinded RSA.
You keep track of the time while doing the comparison, then before spitting back the result you feed the amount of time to a separate function that will sleep (or whatever) a certain amount of predetermined time so that all results process in the same time.
I realize this is a bit excessive, and will slow down your code quite a bit, but if you are really that worried about this type of attack, why not?
(In some languages—hi Ruby!—you might not even have access to reliable millisecond-resolution timing.)