What is the secure procedure for verifying a username and password with bcrypt (or any hash using a salt), without allowing for username enumeration with timing attacks. Without a salt, I know how to do this. Just search for a database match where both the username AND hash match (because you can compute the hash without needing to look up a salt first).
But if a salt is being used, I have to look up the salt first before I can do the comparison. If no record is found, it returns quickly (indicating that user doesn't exist). If I do find the stored salt in the database, then I can run the compare (which is slow, indicating the user exists).
All I can think to do is, if the user record isn't found, run a hash compare on some dummy data anyway. Is there some better way of accomplishing this?