Two clocks

One is a stopwatch you hold against a function on your own machine. The other is at the far end of a network. What can each of them read?

The legible case

for i in 0 .. len(secret):
    if given[i] != secret[i]:
        return False        # leaves early
return True

Every additional leading byte that matches costs one more loop iteration. The duration is a function of how much of the secret you already have.

One measurement says nothing

A single call takes 40-90 ns and the machine’s own noise is wider than that. The effect is real and smaller than the thing measuring it.

The answer is not a better clock. It is more calls.

Ten thousand calls

Now take the clock off the machine

Brumley and Boneh, 2003. OpenSSL RSA decryption, timed from another host on the same network.

There is no comparison against a secret anywhere in it.

Two effects, pulling opposite ways

Effect	What varies with the secret	Direction
Montgomery extra reduction	how often the conditional subtraction fires, as the input nears a prime factor	slower
Karatsuba / normal boundary	which multiplication routine the input’s size selects	faster

Which one dominates depends on the machine. The turnover point is the signal.

What that changes

A timing channel is not a bug class. It is a property of any operation whose duration depends on secret data — including a statistical residue of an optimisation nobody thought of as a branch.

OpenSSL’s fix was blinding the input, not rewriting a comparison.

Duration is a measurement

And a network path is a probe. The attacker needed no access to the machine, no privilege on it, and nothing to look at.

The Bench times both versions of the comparison above, plots mean against agreement length, and asks why one run would not have been enough.

Two clocks#

The legible case#

One measurement says nothing#

Ten thousand calls#

Now take the clock off the machine#

Two effects, pulling opposite ways#

What that changes#

Duration is a measurement#