> btw: isn't the scheme you posted vulnerable to replay attacks too? Much easier than the timing attack.

Yep, probably. In fact now that I look at it definitely, I should have gone with that instead!

I forget who said this but basically any feature that exists in TLS that doesn't exist in your hand-rolled authentication scheme is a vulnerability.