timing-attacks-anti-pattern

What this skill does

# Timing Attacks Anti-Pattern

**Severity:** Medium

## Summary

Attackers measure operation timing to extract secrets. Early-exit comparisons leak information: comparing `ABCDEF` to `ABCDEG` takes longer than `ABCDEF` to `XBCDEF` (more matching characters before mismatch). These timing differences enable character-by-character secret recovery.

## The Anti-Pattern

The anti-pattern is comparison functions returning early upon finding differences in sensitive values (passwords, tokens, hashes).

### BAD Code Example

```python
# VULNERABLE: String comparison leaking timing information.

def insecure_compare(s1, s2):
    # Exits on first mismatch (early exit).
    # First character mismatch returns quickly.
    # Last character mismatch takes longer.
    if len(s1) != len(s2):
        return False
    for i in range(len(s1)):
        if s1[i] != s2[i]:
            return False # Early exit leaks timing.
    return True

SECRET_TOKEN = "abcdef123456"

@app.route("/check_token")
def check_token():
    provided_token = request.args.get("token")
    if insecure_compare(provided_token, SECRET_TOKEN):
        return "Token valid!"
    return "Token invalid!"

# Attack: Measure response times to discover secret character-by-character.
# token=X -> fast (first char wrong)
# token=a -> slower (first char matches)
# token=ab -> even slower (two chars match)
```

### GOOD Code Example

```python
# SECURE: Constant-time comparison prevents timing leaks.
import hmac
import secrets

def secure_compare(s1_bytes, s2_bytes):
    # `hmac.compare_digest` performs constant-time comparison.
    # Execution time depends only on length, not values.
    # Always compares all bytes.
    return hmac.compare_digest(s1_bytes, s2_bytes)

SECRET_TOKEN = secrets.token_bytes(16) # Secure 128-bit token.

@app.route("/check_token_secure")
def check_token_secure():
    provided_token_hex = request.args.get("token")
    try:
        provided_token_bytes = bytes.fromhex(provided_token_hex)
    except ValueError:
        return "Token invalid!", 400

    # Length check handled safely by compare_digest.
    if len(provided_token_bytes) != len(SECRET_TOKEN):
        return "Token invalid!", 400

    if secure_compare(provided_token_bytes, SECRET_TOKEN):
        return "Token valid!"
    return "Token invalid!"
```

## Detection

- **Review code for secret comparisons:** Look for any place in the code where sensitive values (passwords, API keys, session tokens, cryptographic hashes, HMAC signatures) are compared.
- **Identify standard equality operators:** Search for `==` or `===` being used for comparing secrets. These operators are typically not constant-time.
- **Look for custom comparison loops:** If a custom loop iterates through characters and returns `False` on the first mismatch, it's vulnerable.

## Prevention

- [ ] **Use constant-time comparison for secrets:** Never use standard equality operators for sensitive values.
- [ ] **Know constant-time functions:**
  - **Python:** `hmac.compare_digest()` or `secrets.compare_digest()`
  - **Node.js:** `crypto.timingSafeEqual()`
  - **Go:** `subtle.ConstantTimeCompare()`
  - **Java:** `MessageDigest.isEqual()` (byte arrays)
  - **PHP:** `hash_equals()`
- [ ] **Use password library verification:** Libraries like bcrypt/argon2 provide timing-safe verification (`bcrypt.checkpw()`, `argon2.verify()`).
- [ ] **Verify equal lengths:** Constant-time functions handle length mismatches safely, but pre-checking improves clarity.

## Related Security Patterns & Anti-Patterns

- [Weak Password Hashing Anti-Pattern](../weak-password-hashing/): Proper password hashing (e.g., bcrypt) includes protection against timing attacks during verification.
- [JWT Misuse Anti-Pattern](../jwt-misuse/): Signature verification of JWTs should use constant-time comparisons.
- [Padding Oracle Anti-Pattern](../padding-oracle/): Another type of cryptographic timing issue where information about padding validity is leaked through timing.

## References

- [OWASP Top 10 A04:2025 - Cryptographic Failures](https://owasp.org/Top10/2025/A04_2025-Cryptographic_Failures/)
- [OWASP GenAI LLM10:2025 - Unbounded Consumption](https://genai.owasp.org/llmrisk/llm10-unbounded-consumption/)
- [OWASP API Security API2:2023 - Broken Authentication](https://owasp.org/API-Security/editions/2023/en/0xa2-broken-authentication/)
- [OWASP Testing for Timing Attacks](https://owasp.org/www-project-web-security-testing-guide/)
- [CWE-208: Observable Timing Discrepancy](https://cwe.mitre.org/data/definitions/208.html)
- [CAPEC-462: Cross-Domain Search Timing](https://capec.mitre.org/data/definitions/462.html)
- [BlueKrypt - Cryptographic Key Length Recommendation](https://www.keylength.com/)
- Source: [sec-context](https://github.com/Arcanum-Sec/sec-context)