The secure networking problem of embedding information flows into cover traffic is addressed. When relayed packets must obey a causal delay constraint, this naturally remaps to a matching problem between point processes (here taken as arbitrary renewal processes). The best hiding policy is thus characterized in terms of the maximum fraction of matched points, which is accordingly referred to as embedding capacity. For a broad range of renewal models encountered in practice, we provide a simple analytical formula for the capacity, which depends only on the renewal function of the underlying processes, and further find conditions for capacity-ordering of different types of cover traffic. The results are also tested on real network traces, and a very good match is observed, especially for tight delay constraints.