Timing Attacks: Extracting Keys from Execution Time
Demonstrate a cache-timing attack on a non-constant-time implementation.
Timing Attacks: Extracting Keys from Execution Time is a free Cryptology Academy lesson on CoddyKit — lesson 1 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Cryptology Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.
What Is a Timing Attack?
A timing attack is a side-channel attack where an adversary measures how long cryptographic operations take to infer secret data. Even nanosecond differences can leak key bits.
Why Execution Time Leaks Secrets
Branches and memory accesses inside crypto code often depend on secret values. A loop that exits early on a zero bit runs faster — the attacker measures that difference.
Cache-Timing Attacks on AES
Classic AES table lookups hit CPU cache lines whose addresses depend on key bytes. Tools like Flush+Reload let an attacker observe which cache lines were accessed.
The Bleichenbacher RSA Timing Oracle
Bleichenbacher's 1998 attack exploited timing differences in PKCS#1 v1.5 padding validation. Millions of chosen ciphertexts could recover a 1024-bit RSA private key.
Remote Timing Attacks
Even over the network, sub-millisecond timing differences are measurable with enough samples. Lucky13 exploited CBC-mode MAC timing in TLS over the internet.
Measuring Time in Python
Use time.perf_counter_ns() for nanosecond resolution. To demonstrate a vulnerable compare:
import time
def vulnerable_compare(a, b):
for x, y in zip(a, b):
if x != y:
return False
return len(a) == len(b)
start = time.perf_counter_ns()
vulnerable_compare(b"secret_key_here", b"wrong_key_xxxxx")
elapsed = time.perf_counter_ns() - start
print(f"Elapsed: {elapsed} ns")Simulating a Timing Oracle
A timing oracle returns whether a guess is correct AND leaks timing. We can recover a secret byte-by-byte by measuring which guess takes longest before returning False.
Statistical Analysis of Timing Data
Single measurements are noisy. Attackers collect thousands of samples per candidate and use statistical tests (t-test, Welch's test) to distinguish signal from noise.
Manger's Attack on OAEP
In 2001, Manger showed that even OAEP-padded RSA leaks information if the implementation distinguishes "first byte is zero" from other errors with different timing.
Real-World Examples
OpenSSL, GnuTLS, and NSS have all had timing attack CVEs. The Lucky13 TLS attack (CVE-2013-0169) affected virtually every TLS library at the time of disclosure.
Knowledge Check
What statistical technique helps attackers distinguish timing signal from measurement noise?
Lesson Recap
Timing attacks extract cryptographic secrets by measuring execution time differences. They work locally (cache) or remotely (network). Statistical analysis separates signal from noise. The fix is constant-time code — covered in the Countermeasures lesson.
Frequently asked questions
Is the “Timing Attacks: Extracting Keys from Execution Time” lesson free?
Yes — the full text of “Timing Attacks: Extracting Keys from Execution Time” is free to read here on the web, and the Cryptology Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Cryptology Academy course, upgrade to CoddyKit PRO.
What will I learn in “Timing Attacks: Extracting Keys from Execution Time”?
Demonstrate a cache-timing attack on a non-constant-time implementation. You practise Cryptology Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.
Do I need any experience to start Cryptology Academy?
No prior experience is required. Cryptology Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 1 of 4, so you can start here or from the beginning and move at your own pace.
How long does the “Timing Attacks: Extracting Keys from Execution Time” lesson take?
Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.
Can I write and run code in this Cryptology Academy lesson?
Yes. Every Cryptology Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.
All lessons in this course
- Timing Attacks: Extracting Keys from Execution Time
- Power Analysis: SPA & DPA
- Electromagnetic & Acoustic Side Channels
- Countermeasures: Masking, Blinding & Constant-Time Code