Why is implementation relevant to timing attacks?
Cryptography Stack Exchange Q&A on why constant-time implementation, not just algorithm choice, defends against timing and side-channel attacks, covering the realistic attack model and data-dependent operations.
Overview
This Cryptography Stack Exchange question asks why the software implementation of a cryptographic primitive, not merely the abstract algorithm, determines resistance to timing attacks. A timing attack is a side-channel attack that recovers secret material (keys, nonces, plaintext) by measuring how long an operation takes, since execution time can depend on secret-dependent branches, memory-access patterns, or arithmetic. The accepted answers clarify a subtle point about the attack model and explain why cryptographic libraries invest heavily in constant-time code.
Key points
- The questioner’s premise, that implementation is irrelevant because an attacker could just pick a timing-vulnerable implementation, assumes an unrealistic attack model. In practice the victim, not the attacker, chooses which library runs on the victim’s own machine.
- Allowing an attacker to choose the code executing on the victim’s hardware would trivially break essentially any security primitive, so that model is discarded as meaningless.
- Under a realistic model, the same algorithm can be implemented safely or unsafely. Timing leaks come from data-dependent operations: secret-dependent conditional branches, table lookups indexed by secret values, early-exit comparisons, and variable-time arithmetic.
- The defense is constant-time implementation: code whose execution time and memory-access pattern are independent of secret data. This is an implementation property, not an algorithm property, which is precisely why implementation matters.
- Well-designed cryptographic libraries deliberately avoid branches and lookups that depend on secrets, so a mathematically sound algorithm is not undermined by an incautious implementation.
Relevance to Truestamp
Truestamp signs data with Ed25519, a signature scheme designed for fast, branch-free, constant-time implementations that resist exactly the timing and side-channel leaks this discussion describes, an important property for the Ed25519 signatures that authenticate its proofs.
Citations
- Why is implementation relevant to timing attacks?. Cryptography Stack Exchange community Q&A.