Timing Attacks
This is one of the easiest side channel attacks to execute. The most famous instance of this happened with a very popular password safe. It wasn't something large that compromised their system but a single line of code.
return Arrays.equals(hmac.doFinal(), sigBytes); The problem with that code is that it does a byte by byte comparison which can be explained easier by saying it was comparing letter by letter. If the password was P@ssw0rd and the user guest the safe would check the first letter and return with an incorrect login message. If the user had typed P@rakeet instead the safe wouldn't fail out till the third letter. By timing these differences the thief could letter by letter guess the password based on how long it took before they got an incorrect login message. |