Hacker News Reader

Because the specification does not mandate a constant time operation.

You are not mandated a constant-time aes implementation either.

nobody cares about an AES constant time implementation, but any specification about MACs and signing algorithms will specifically mention that you need to have constant-time operations

Reply on news.ycombinator.com