Intermediate LevelWeb Security & Cyber Defense
What is a Timing Side-Channel Attack and how does crypto.timingSafeEqual prevent it?
❓ Interview Prompt: Explain Timing Side-Channel attacks, string comparison execution time variations, leak of secret tokens, and constant-time algorithms.
Timing Side-Channel Attacks exploit microsecond execution time differences in non-constant-time string comparison algorithms ('if (input === secret)'):
Exploit Mechanics:
Standard string '==' checks byte-by-byte and short-circuits immediately on the first non-matching byte.
•
An attacker measures server response time down to nanoseconds. A response taking $1.2\mu s$ means character 1 was wrong; $1.5\mu s$ means character 1 was right! The attacker guesses secret tokens character-by-character.
•
Defense: Use 'crypto.timingSafeEqual()', which compares all bytes in constant time regardless of where mismatches occur.
Code Implementation Example
typescript
import crypto from 'crypto';
export function safeCompareTokens(a: string, b: string): boolean {
const bufA = Buffer.from(a);
const bufB = Buffer.from(b);
if (bufA.length !== bufB.length) return false;
// ✅ Constant-Time Comparison prevents timing side-channel attacks!
return crypto.timingSafeEqual(bufA, bufB);
}💡Comparing secret authentication tokens in constant time with crypto.timingSafeEqual.
🎯 Interview Key Takeaway
Use constant-time string comparison functions (crypto.timingSafeEqual) to neutralize timing side-channel attacks on secret tokens.
#Timing Attacks#Constant Time#Side-Channel#Intermediate
Back to all Web Security & Cyber Defense Questions→