# Timing Attack Vulnerability

> Detects comparison operations on secrets using non-constant-time functions, enabling timing side-channel attacks.

- Skill: `zakirkun/timing-attack-vulnerability` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add zakirkun/timing-attack-vulnerability`
- Raw SKILL.md: https://api.skillmd.com/api/skills/zakirkun/timing-attack-vulnerability/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: zakirkun (https://skillmd.com/u/zakirkun)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/zakirkun/timing-attack-vulnerability

---


# Timing Attack Vulnerability

## Overview
String comparison functions (`==`, `===`, `strcmp`) short-circuit on the first mismatched character. Measuring response times reveals how many characters of a secret match the attacker's guess. This is exploitable for:
- API key validation
- HMAC signature verification
- Session token comparison
- Password comparison (before hashing)

## Remediation
Use constant-time comparison functions:
- Python: `hmac.compare_digest()`
- Go: `subtle.ConstantTimeCompare()`
- Node.js: `crypto.timingSafeEqual()`
- PHP: `hash_equals()`
- Java: `MessageDigest.isEqual()`