Timing Attack
A timing attack infers secrets from response-time differences: how long a comparison, decryption, or lookup takes leaks bits of the secret one branch at a time.
Definition
A timing attack measures execution time variations caused by secret-dependent control flow or data access. String comparisons that return at the first mismatching byte, cache line residency keyed by secret offsets, and exponent-dependent decryption paths all leak information through duration. Defense is constant-time code that performs identical operations regardless of secret values.
Context and scope
Classic against token comparison endpoints and MAC verification, and demonstrated at scale against TLS via timing side channels. Relevant anywhere secrets influence code paths.
Common misconceptions
- Fast servers are immune — attacks average millions of noisy samples to extract single-bit signals
- Comparing hashes instead of tokens fixes it — comparing the digest of a secret is still variable-time unless the comparison itself is constant-time
- Adding random delay hides the signal — random jitter adds variance; constant-time removes the signal entirely
Anti-patterns
- Verifying API tokens with early-exit string comparison and leaking token length and prefix
- Comparing HMACs or signatures with standard equality operators instead of constant-time comparison
- Caching or memoizing lookups keyed by secret material and exposing data-dependent latency
Related concepts
Related examples
Authoritative source
What it is
Computation time is an output channel. If runtime depends on secret bytes — early exit in comparison, table lookups indexed by secrets — the attacker measures and models timing to recover those bytes without ever breaking the cryptography.
How it works
The attacker submits many crafted inputs and statistically correlates response duration with hypotheses about the secret. A comparison that bails at the first differing byte is fastest when the guess diverges early, so each correct prefix byte is distinguishable. Network jitter is defeated by repetition and median statistics.
When to care
Token and MAC verification, login flows comparing hashes, crypto implementations, and cache or database lookups whose timing depends on secret-keyed access patterns. Any equality check on secrets is suspect.
Pitfalls
Constant-time libraries exist for exactly this: crypto.subtle.timingSafeEqual in Node, constant_time_eq in Python. Hashing secrets before comparison still requires constant-time comparison of the digests. Measure your endpoints: if p99 of the invalid-token branch differs measurably from the valid branch, you have a signal to remove.