Observable Timing Discrepancy

Description

In security-relevant contexts, even small variations in timing can be exploited by attackers to indirectly infer certain details about the product's internal operations. For example, in some cryptographic algorithms, attackers can use timing differences to infer certain properties about a private key, making the key easier to guess. Timing discrepancies effectively form a timing side channel.

Demonstrations

The following examples help to illustrate the nature of this weakness and describe methods or techniques which can be used to mitigate the risk.

Note that the examples here are by no means exhaustive and any given weakness may have many subtle varieties, each of which may require different detection methods or runtime controls.

Example One

Consider an example hardware module that checks a user-provided password to grant access to a user. The user-provided password is compared against a golden value in a byte-by-byte manner.

always_comb @ (posedge clk)

begin

  assign check_pass[3:0] = 4'b0;
  for (i = 0; i < 4; i++) begin

    if (entered_pass[(i*8 - 1) : i] eq golden_pass([i*8 - 1) : i])

      assign check_pass[i] = 1;
      continue;

    else

      assign check_pass[i] = 0;
      break;

    end

  assign grant_access = (check_pass == 4'b1111) ? 1'b1: 1'b0;

end

Since the code breaks on an incorrect entry of password, an attacker can guess the correct password for that byte-check iteration with few repeat attempts.

To fix this weakness, either the comparison of the entire string should be done all at once, or the attacker is not given an indication whether pass or fail happened by allowing the comparison to run through all bits before the grant_access signal is set.

always_comb @ (posedge clk)
begin

  assign check_pass[3:0] = 4'b0;
  for (i = 0; i < 4; i++) begin

    if (entered_pass[(i*8 - 1) : i] eq golden_pass([i*8 -1) : i])

      assign check_pass[i] = 1;
      continue;

    else

      assign check_pass[i] = 0;
      continue;

    end

  assign grant_access = (check_pass == 4'b1111) ? 1'b1: 1'b0;

end

Example Two

In this example, the attacker observes how long an authentication takes when the user types in the correct password.

When the attacker tries their own values, they can first try strings of various length. When they find a string of the right length, the computation will take a bit longer, because the for loop will run at least once. Additionally, with this code, the attacker can possibly learn one character of the password at a time, because when they guess the first character right, the computation will take longer than a wrong guesses. Such an attack can break even the most sophisticated password with a few hundred guesses.

def validate_password(actual_pw, typed_pw):

  if len(actual_pw) <> len(typed_pw):
    return 0

  for i in len(actual_pw):
    if actual_pw[i] <> typed_pw[i]:
      return 0


  return 1

Note that in this example, the actual password must be handled in constant time as far as the attacker is concerned, even if the actual password is of an unusual length. This is one reason why it is good to use an algorithm that, among other things, stores a seeded cryptographic one-way hash of the password, then compare the hashes, which will always be of the same length.

See Also