Let's say my server has a non-constant-time compare function for checking if the visitor has a valid session id. The time it takes for the comparator to run would be very insignificant, usually within 1 millisecond (I've tried to compare two strings that are both 1000 characters long). Not to mention the variance in time for the network speed. So does it mean timing attack is not practical? What do web developers have to be aware of regarding timing attack?

  • 1
    $\begingroup$ You may want to have a look at this paper (PDF) and at this Q&A on InfoSec.SE $\endgroup$ – SEJPM Aug 11 '18 at 10:16
  • 3
    $\begingroup$ An attacker can usually rent a machine in the same datacenter as your server, which significantly cuts down network latency and jitter. $\endgroup$ – CodesInChaos Aug 11 '18 at 10:37
  • $\begingroup$ You'd be amazed what can be done with statistics. For instance, if there is some kind of minimum / maximum latency then it would be easy to extract even ms kind of timings by just looking at the low / high values. And computers are darn good at patiently getting millions if not billions of samples. This is also why statistics is very important to anyone wanting to do crypt-analysis. And don't forget attacks such as cache timing attacks which may be feasible if you use a naive string comparison. $\endgroup$ – Maarten Bodewes Aug 11 '18 at 18:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.