title: Python library or technique to defend against timing side channel attack
body: <p>Consider a <em>login</em> API entry point that gets a <em>username</em> and a <em>password</em>.</p>
  
  <p>The password is securely hashed and salted, and following a proper practice we return an identical response either if the username doesn't exists or the password is incorrect.</p>
  
  <pre><code>def verify_user(session, username, password):
      user = session.query(Users.username == 'username').one()
      stored_hash = user.password_hash if user is not None else 'some-dommy-hash'
      return verify_password(password=password, hash=stored_hash)
  </code></pre>
  
  <p>Note that we also try to make sure that both control flow will do <em>about</em> the same amount of work, so they <em>should</em> take <em>about</em> the same amount of time.</p>
  
  <p>But the <em>about</em> and <em>should</em> is what got me worried.</p>
  
  <p>Is it safe to assume that finding and not finding a user in the database take the same amount of time? Can I assume that hashing the same dummy hash will not be cached?</p>
  
  <p>What I really want is a way to have something like:</p>
  
  <pre><code>def constant_time_verify_user(time, session, username, password):
      with constant_time(time):
          ans = verify_user(session, username, password)
      return ans
  </code></pre>
  
  <p>where <code>constant_time</code>, is something like timeout, in the sense that it will take <em>exactly</em> a given amount of time.</p>
  
  <p>So my question: <strong>Is there a well established practice, or a library that will help to obscure the amount of time an operation might take, in order to defend against time based attacks</strong>?</p>
  
  <hr>
  
  <p>Edit: <a href="https://stackoverflow.com/users/5588279/">@Staw</a>'s <a href="https://stackoverflow.com/a/49850639/110488">answer</a> suggested that the motivation for this was unclear, and indeed, I am trying to prevent information leak about the existence of users in the database.</p>