Why the indirect comparison of MACs in ChaCha20_Poly1305?

[Pascal Chambon]

Hello everyone,

In ChaCha20_Poly1305.py, in the verify method, I was surprised that instead of comparing the 2 MACs (the received one and the real one), the algorithm uses BLAKE2:

secret = get_random_bytes(16)

self._compute_mac()

mac1 = BLAKE2s.new(digest_bits=160, key=secret,
data=self._mac_tag)
mac2 = BLAKE2s.new(digest_bits=160, key=secret,
data=received_mac_tag)

I guess that this is done in order to avoid timing attacks on this operation, am I right ?

thanks

regards,

P. Chambon