Covert Timing Channel

From Guidance Share

Jump to: navigation, search



Unintended information is leaked through observing the timing of events.

Applies To

  • Languages: All
  • Operating platforms: All


In Python:

def validate_password(actual_pw, typed_pw):
if len(actual_pw) <> len(typed_pw):
return 0
for i in len(actual_pw):
if actual_pw[i] <> typed_pw[i]:
return 0
return 1

In this example, the attacker can observe how long an authentication takes when the user types in the correct password. When the attacker tries his own values, he can first try strings of various length. When he finds a string of the right length, the computation will take a bit longer because the for loop will run at least once. Additionally, with this code, the attacker can possibly learn one character of the password at a time, because when he guesses the first character right, the computation will take longer than when he guesses wrong. Such an attack can break even the most sophisticated password with a few hundred guesses. Note that, in this example, the actual password must be handled in constant time, as far as the attacker is concerned, even if the actual password is of an unusual length. This is one reason why it is good to use an algorithm that, among other things, stores a seeded cryptographic one-way hash of the password, then compare the hashes, which will always be of the same length.


  • Confidentiality: Information leakage.


  • Failure to consider how timing changes can result in information disclosure


  • Design: Whenever possible, specify implementation strategies that do not introduce time variances in operations.
  • Implementation: Artificially manipulating the amount of time in which sensitive operations take place can reduce the chances of revealing information to the attacker.

Vulnerability Patterns

How Tos

Personal tools