Fun with Timing Attacks
Skip straight to the demo
Let’s say you’re writing a function that takes user input and checks if it matches some secret.
You’ll be exposing this checkSecret function to external users so you want to make sure it’s safe to use without leaking the secret. As long as your secret is long enough, it’s unlikely to be brute-forced. You’re feeling pretty confident that this simple function that does nothing but check equality doesn’t have any glaring security flaws.
Code for checkSecret
const SUPER_SEC...
Read more at ostro.ws