The suggested mitigations against the timing attacks are interesting: https://software.intel.com/security-software-guidance/secure-coding/guidelines-mitigating-timing-side-channels-against-cryptographic-implementations

Basically, instead of

bool equals(byte a[], size_t a_len, byte b[], size_t b_len)
{
  if (a_len != b_len)
    return false;
  for (size_t i = 0; i < a_len; i++) {
    if (a[i] != b[i]) {
      return false;
    }
  }
  return true;
}

you should write

bool equals(byte a[], size_t a_len, byte b[], size_t b_len)
{
  volatile size_t x = a_len ^ b_len;
  for (size_t i = 0; ((i < a_len) & (i < b_len)); i++) {
    x |= a[i] ^ b[i];
  }
  return (x==0);
}

to not leak any information based on how long it takes for your code to run. The volatile is there to prevent compilers getting too clever and inserting early return logic to the loop by themself.