1 files changed, 35 insertions, 1 deletions
diff --git a/Doc/library/hmac.rst b/Doc/library/hmac.rst
index eff27241bc..95756933d1 100644
--- a/Doc/library/hmac.rst
+++ b/Doc/library/hmac.rst
@@ -19,7 +19,7 @@ This module implements the HMAC algorithm as described by :rfc:`2104`.
    Return a new hmac object.  *key* is a bytes object giving the secret key.  If
    *msg* is present, the method call ``update(msg)`` is made.  *digestmod* is
    the digest constructor or module for the HMAC object to use. It defaults to
-   the :func:`hashlib.md5` constructor.
+   the :data:`hashlib.md5` constructor.
 
 
 An HMAC object has the following methods:
@@ -38,6 +38,13 @@ An HMAC object has the following methods:
    given to the constructor.  It may contain non-ASCII bytes, including NUL
    bytes.
 
+   .. warning::
+
+      When comparing the output of :meth:`digest` to an externally-supplied
+      digest during a verification routine, it is recommended to use the
+      :func:`compare_digest` function instead of the ``==`` operator
+      to reduce the vulnerability to timing attacks.
+
 
 .. method:: HMAC.hexdigest()
 
@@ -45,6 +52,13 @@ An HMAC object has the following methods:
    length containing only hexadecimal digits.  This may be used to exchange the
    value safely in email or other non-binary environments.
 
+   .. warning::
+
+      When comparing the output of :meth:`hexdigest` to an externally-supplied
+      digest during a verification routine, it is recommended to use the
+      :func:`compare_digest` function instead of the ``==`` operator
+      to reduce the vulnerability to timing attacks.
+
 
 .. method:: HMAC.copy()
 
@@ -52,6 +66,26 @@ An HMAC object has the following methods:
    compute the digests of strings that share a common initial substring.
 
 
+This module also provides the following helper function:
+
+.. function:: compare_digest(a, b)
+
+   Return ``a == b``.  This function uses an approach designed to prevent
+   timing analysis by avoiding content-based short circuiting behaviour,
+   making it appropriate for cryptography.  *a* and *b* must both be of the
+   same type: either :class:`str` (ASCII only, as e.g. returned by
+   :meth:`HMAC.hexdigest`), or a :term:`bytes-like object`.
+
+   .. note::
+
+      If *a* and *b* are of different lengths, or if an error occurs,
+      a timing attack could theoretically reveal information about the
+      types and lengths of *a* and *b*--but not their values.
+
+
+   .. versionadded:: 3.3
+
+
 .. seealso::
 
    Module :mod:`hashlib`