Let's say my server has a non-constant-time compare function for checking if the visitor has a valid session id. The time it takes for the comparator to run would be very insignificant, usually within 1 millisecond (I've tried to compare two strings that are both 1000 characters long). Not to mention the variance in time for the network speed. So does it mean timing attack is not practical? What do web developers have to be aware of regarding timing attack?

  • 1
    $\begingroup$ You may want to have a look at this paper (PDF) and at this Q&A on InfoSec.SE $\endgroup$
    – SEJPM
    Commented Aug 11, 2018 at 10:16
  • 3
    $\begingroup$ An attacker can usually rent a machine in the same datacenter as your server, which significantly cuts down network latency and jitter. $\endgroup$ Commented Aug 11, 2018 at 10:37
  • $\begingroup$ You'd be amazed what can be done with statistics. For instance, if there is some kind of minimum / maximum latency then it would be easy to extract even ms kind of timings by just looking at the low / high values. And computers are darn good at patiently getting millions if not billions of samples. This is also why statistics is very important to anyone wanting to do crypt-analysis. And don't forget attacks such as cache timing attacks which may be feasible if you use a naive string comparison. $\endgroup$
    – Maarten Bodewes
    Commented Aug 11, 2018 at 18:38


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.