Password hashing function almost by definition does not handle any data that must be protected from the user, so side channel leaks do not make much sense. Only secret information comes into play in final comparison of hash of user supplied password and your stored hash and I don't see any way of exploiting possible timing leak in that comparison that does not require breaking the hash in the first place.
Comments
Password hashing function almost by definition does not handle any data that must be protected from the user, so side channel leaks do not make much sense. Only secret information comes into play in final comparison of hash of user supplied password and your stored hash and I don't see any way of exploiting possible timing leak in that comparison that does not require breaking the hash in the first place.