Home/Threats/Timing Attacks

Timing Attacks

When Time Reveals Secrets

10 min read Updated 2024

What Are Timing Attacks?

Timing attacks extract information by measuring how long operations take. Variations in processing time can reveal secret data, verify usernames, or correlate anonymous traffic.

Classic Example
// Vulnerable password comparison
if (input == password) return true;

// "abc" vs "xyz" - fast failure (first char wrong)
// "pas" vs "xyz" - slow failure (matched 3 chars)
// Time difference reveals how many chars matched!

Attack Categories

Cryptographic

Extract keys from encryption timing

Crypto

Username Enumeration

Detect valid users by response time

Auth

Network Correlation

Link anonymous traffic via timing

Anonymity

Cache Timing

CPU cache reveals memory access

Hardware

Famous Timing Attacks

Spectre/MeltdownCPU speculation leaks via timing
BEAST/CRIMETLS compression timing attacks
RSA TimingExtract private keys from operation timing

Mitigations

  • Constant-time comparison functions
  • Add random delays (with caution)
  • Use constant-time crypto libraries
  • Rate limiting reduces precision
  • Return generic error messages
  • Hardware security modules for crypto