Definition
A timing attack is a type of side-channel attack where an attacker exploits the time it takes for a system to perform cryptographic operations to infer sensitive information. By carefully measuring the execution time of these operations, an attacker can deduce patterns or differences that reveal secret keys or other confidential data. This method relies on the fact that certain operations might take slightly longer to complete depending on the input data, a subtle variation that can be exploited. For instance, an attacker might measure the time taken to verify a password or decrypt a message, correlating longer times with specific incorrect guesses. This differs from brute-force attacks which rely on trying all possible combinations directly rather than analyzing performance. Understanding timing attacks is crucial for secure system design and is a common topic on exams like Security+ and CISSP.