Skip to main content

57. Side-Channel Attacks: Silent Hacking

Even when a cryptographic algorithm is mathematically perfect, its implementation can be breached. Side-Channel Attacks target that exact gap.

Core Concept​

Instead of analyzing the code itself, use byproduct information leaked during execution.

  • Timing: Infer secret values from differences in execution time
  • Power: Analyze power-consumption waveforms (SPA / DPA)
  • Electromagnetic (EM): Measure emitted electromagnetic waves
  • Cache: Observe CPU cache hit/miss patterns, such as Flush+Reload

Timing Attack Example​

# Vulnerable comparison — compares one character at a time and leaks timing
def bad_compare(a, b):
    for x, y in zip(a, b):
        if x != y:
            return False
    return True

# Safe comparison — always takes the same amount of time
import hmac
def safe_compare(a, b):
    return hmac.compare_digest(a, b)

The early-return approach produces different response times depending on the number of matching characters. By sending thousands of requests and averaging the results, an attacker can recover a token one byte at a time.

Cache Timing: Flush+Reload​

  1. Invalidate the shared-memory cache with clflush
  2. Cause the victim process to access that address
  3. Measure the access time again → a cache hit means the victim accessed it

This is a classic attack path for recovering key bytes from an AES T-table implementation.

CTF Application​

Many challenges can be solved with remote timing alone, without power analysis.

# Simple timing-measurement script
for i in $(seq 0 255); do
  python3 -c "
import socket, time
s = socket.create_connection(('target', 9999))
payload = bytes([${i}]) + b'A'*15
start = time.perf_counter()
s.sendall(payload)
s.recv(1024)
print(${i}, time.perf_counter()-start)
"
done

Defenses​

  • Constant-time implementations are essential
  • Use validated libraries such as hmac.compare_digest
  • Insert hardware noise and add random delays
  • Use dedicated security chips such as HSMs and SEs for sensitive operations

“Mathematics may be perfect, but silicon lies.”