Timing Attack.

Timing attacks exploit input-dependent execution time in cryptographic and authentication code. Classic targets are non-constant-time string comparisons (an early-mismatch byte short-circuits and reveals how far the guess matched), modular exponentiation (square-and-multiply leaking key bits), AES table lookups affected by cache state, and account lookups whose duration reveals whether a username exists. Even nanosecond differences can be amplified by averaging thousands of measurements to suppress network jitter.

Paul Kocher's 1996 paper first weaponized this against RSA and Diffie-Hellman. Crucially, Brumley and Boneh's 2003 "Remote Timing Attacks Are Practical" (USENIX Security) extracted an OpenSSL 0.9.7 RSA private key over a network, exploiting timing variation in Montgomery reduction and the Karatsuba/normal multiplication switch — this is why OpenSSL enabled RSA blinding by default. Lucky Thirteen (CVE-2013-0169, 2013) recovered TLS plaintext by measuring MAC-verification time differences in CBC-mode padding handling.

flowchart TD
  A[Attacker submits many crafted inputs] --> B[Measure precise response time]
  B --> C[Average samples to cancel jitter]
  C --> D{Time correlates<br/>with secret?}
  D -->|Yes| E[Infer one bit/byte of secret]
  E --> F[Repeat, narrowing key space]
  F --> G[Full secret recovered]
  D -->|No| H[Constant-time code: no leak]

Defences require constant-time implementations: branch-free conditional moves, fixed-time comparisons (crypto_memcmp, Python's hmac.compare_digest, Java's MessageDigest.isEqual), blinding for RSA/ECC, and cache-hardened cipher primitives. Automated tooling (dudect, ctgrind, MicroWalk) helps audit for data-dependent timing, and rate-limiting narrows the attacker's measurement budget at network boundaries.