I wonder if there is a difference between side channel attack and eavesdropping attack. To me both seems similar



Eavesdropping means that someone (usually someone named Eve...) eavesdrops on Alice's communication with Bob. Eavesdropping can break the security of a system, for example when the protocol has passwords transmitted in plaintext.

A sidechannel attack takes advantage of information leaked via (insert drums here) a side channel which you watch to break a system. Sidechannel attacks don't need to involve any eavesdropping on actual communications between Alice and Bob; the attacker might just attack the system directly and observe a given side channel.

For example, here's a simple side-channel attack against naive implementations of a password check that uses a for loop to check each secret character against a provided password:

def check_password(provided):
   secret = 'open-sesame'
   for i in range(len(secret):
       if provided[i] != secret[i]:
           return False
   return True

(The above python code wouldn't work in real life, but bear with me): If you use such a check, it takes less time when the first character is wrong than it takes when the first character is right, because the for loop will be terminated in the first iteration. So you can simply try a password starting with A, then with B, then with C and so on and measure the time it takes for it to be rejected by check_password. When it takes a bit longer, you know you have the right first character. Now repeat that with the second character, etc.

The communication going on here is that you're providing the check_password function with a password and get a True or False (accepted or rejected) answer. The time it takes for the password to be accepted or rejected is the side channel, and since the time isn't the same for accepted and rejected passwords, the system leaks information over this side channel, which can be exploited to turn password guessing into a O(n) operation, where n is the length of the password in characters.

You might think such tiny differences in timing can't be exploited, but it's been shown that such timing attacks even work remotely (e.g. by measuring how long it takes the server to reply with a "access denied" message), provided that you collect enough statistical information about how long the average answer takes to reach you.

https://www.sjoerdlangkemper.nl/2016/11/01/tenex-password-bug/ describes an older timing attack against password checking found on the tenex operating system which exploited timing differences introduced by the paging infrastructure . That one's pretty famous and the provided link has a nice and detailed explanation.

Timing attacks are just one example of side-channel attacks. Another side-channel is power consumption, and recently Bruce Schneider blogged about a research paper that used an attack using wifi radiation patterns to determine your smart phone password. Also see news article about it.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.