In Laravel (a PHP framework) I can see that they calculate a HMAC with a random key over the final HMAC before comparison. This additional HMAC calculation is of course performed for both the calculated MAC and the received MAC value, using this randomized key.
Does this just supply a method of performing a "constant time" compare? Or does it add other security properties to the MAC calculation. I presume the former, but I want to be sure. Is this a known technique for performing MAC comparisons?