Timing Side-Channel Attack (Computational Cost as an Oracle)
- •
What it is
- •
A broad, extremely common real-world attack class where the time a service takes to respond leaks information the response's content is supposed to keep hidden — because different secret-dependent code paths take measurably different amounts of computation. If one branch of server logic does something computationally expensive (a large modular exponentiation, a database lookup, an early-exit string comparison) and another branch is comparatively cheap, an attacker who can query repeatedly and measure response latency can often distinguish which branch executed — recovering the secret bit that decided the branch — without touching the "intended" cryptographic hardness of the scheme at all.
- •
- •
When to apply
- •
A service's behavior depends on a secret bit/value in a way that plausibly costs different amounts of computation depending on its value ("if secret bit is 1, do a real cryptographic operation; if 0, return something cheap") — worth trying before diving into the intended, often much harder, mathematical attack, especially under time pressure.
- •
- •
Math
- •
No formal derivation — this is fundamentally empirical and statistical. Reliability depends on the size of the timing gap relative to noise (network jitter, server load); repeating each measurement multiple times and comparing against an empirically-chosen threshold filters out noise.
- •
- •
Worked example
- •
Locally measuring a large modular exponentiation (a 512-bit random exponent) against simply generating a random integer of the same size showed roughly a 700–800x timing difference (hundreds of microseconds vs about 1 microsecond) — a gap large enough to remain clearly distinguishable even after being diluted by real network round-trip latency and jitter, especially when aggregated over several requests per measurement.
- •
- •
Python
- •
import time def measure(payload, n_samples=5): t0 = time.time() for _ in range(n_samples): send(payload) recv() return time.time() - t0 fast_ref = measure(known_fast_payload) slow_ref = measure(known_slow_payload) threshold = fast_ref + (slow_ref - fast_ref) * 0.5 bit = 1 if measure(target_payload) > threshold else 0
- •
- •
Cards
- •
Why might a timing side-channel attack succeed even when the "intended" cryptographic attack is very hard?
- •
The secret-dependent computational cost difference is a completely separate information leak from the scheme's mathematical hardness — the crypto can be sound while the implementation still leaks through timing.
- •
- •
What practical technique improves reliability of a timing measurement against network noise?
- •
Aggregating several requests per measurement and calibrating a threshold against known-fast and known-slow reference measurements, rather than trusting a single request's timing.
- •
- •