← Applied Cryptographic EngineeringAuthentication and passwords

A timing leak in a MAC check

An early-exit comparison takes longer the more leading bytes match. Measure it and recover a secret tag one character at a time.

Secret tag on the server••••••••
Attacker’s guess so far········
0
1
2
3
4
5
6
7
8
9
a
b
c
d
e
f
requests so far 0brute force would need up to 16⁸ ≈ 4.3·10⁹ guesses
1 / 9
The server checks a secret 8-character tag with an early-exit compare: it stops at the first wrong character. Every extra matching character costs about 4 ns more. Timings here are simulated. Press play.

What to notice

  • Each correct character adds a few nanoseconds. Averaged over many requests, that difference stands out from the noise.
  • The attacker needs 16 guesses per hex character, not 16ⁿ for the whole tag: the search becomes linear instead of exponential.
  • A constant-time comparison (hmac.compare_digest, crypto.timingSafeEqual, CRYPTO_memcmp) always looks at every byte, and the bars go flat.