3 ms·
The critical component is that the time is "data dependent". Cryptographic keys (and derived materials) are data, so a data dependent execution time could leak
by gizmo686 4y ago
The critical component is that the time is "data dependent". Cryptographic keys (and derived materials) are data, so a data dependent execution time could leak information about the keys.
As a simple example, consider a naive password check:
char* realPass;
char* guess;
for(int i=0; i<len; i++){
if(realPass[i] != guess[i]) return false
}
return true.
You might think that this function only tells you if the guess was correct or not. But it actually can tell you which character is the first incorrect one. With enough tries and some statistical analysis, this sort of attack had been demonstrated even over the internet.