When verifying a (HMAC) authentication tag it is often indicated that a constant-time comparison is required for security. I can see how leaking information about a password hash can introduce a mild vulnerability as the password hash may become known. However, we're talking here about a calculation over a known and randomized ciphertext.
What would be the vulnerability if we were to perform a non-time constant comparison? Could it be that it would allow recovery of secrets (e.g., passwords) used to derive the authentication key?
Are there other attacks possible if we assume that the derived keys are fully randomized (i.e., no information about the value of the individual bits is known to the attacker?)