Timing Attack Vulnerability

Detects comparison operations on secrets using non-constant-time functions, enabling timing side-channel attacks.

zakirkun 5130862 2 files · 2.4 KB Updated

File contents

Timing Attack Vulnerability

Overview

String comparison functions (==, ===, strcmp) short-circuit on the first mismatched character. Measuring response times reveals how many characters of a secret match the attacker's guess. This is exploitable for:

  • API key validation
  • HMAC signature verification
  • Session token comparison
  • Password comparison (before hashing)

Remediation

Use constant-time comparison functions:

  • Python: hmac.compare_digest()
  • Go: subtle.ConstantTimeCompare()
  • Node.js: crypto.timingSafeEqual()
  • PHP: hash_equals()
  • Java: MessageDigest.isEqual()

zakirkun/ice-tea/tree/main/skills/crypto/timing-attack commit 5130862d40

Frequently asked questions

npx skillmds@latest add zakirkun/timing-attack-vulnerability