thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Application & OT Security · Advanced

Timing Attack

Inferring secret information by measuring how long operations take.

Definition

String comparisons that return early on the first mismatched byte leak how much of a token or HMAC is correct; response time differences can also reveal whether a username exists. Mitigations include constant-time comparison functions and uniform processing paths.

Example

Using hmac.compare_digest instead of == to compare API signatures.

Exam tip

Use constant-time comparison for secrets and tokens.

Related terms