Could someone please tell me what a string comparison timing attack is in simple terms? I have Googled this, but all the explanations are very technical. Also, is this attack an better than a brute force attack? Please correct me if I am wrong, but I believe this attack is used to crack passwords.
When checking strings for equality you need to check that every character matches. Most programming languages will take a short-cut and return False - or Not Equal - as soon as they find a single character that doesn't match. For example,
str1 = "1111111111111111" str2 = "1101111111111111"
You know that they are not equal as soon as you hit that 0, why would you keep checking?
This is super exploitable. Imagine that I'm trying to crack a password (or a hash, or a MAC tag, or anything that needs to be compared for equality), knowing that the server will do a lazy string comparison somewhere inside, I might get the following timing results (completely made up):
Tried "aaaaaaaa", it took 0.2 ms Tried "bbbbbbbb", it took 0.2 ms Tried "cccccccc", it took 0.4 ms
Cool, now I know that the first letter is 'c' because it took longer. Now I can do the same trick with "caaaaaaa", "cbbbbbbb", etc. Cracking one letter at a time is HUGELY faster than cracking the whole password at a time.
This "lazy" string comparison is generally a good thing for programmers because it makes things run faster, but it's bad for security. Secure string comparisons will check all the way to the end, even if it found a difference so that there's never a timing difference.