ISC2 CISSP Practice Question

A timing attack is a type of side-channel attack where an attacker analyzes the time taken to execute cryptographic algorithms. By carefully measuring the time required to perform certain operations, attackers can extract sensitive information such as encryption keys. For example, if a comparison between a user-supplied password and the actual password exits early on the first mismatch, an attacker can use the timing difference to determine the password character by character. This differs from brute force attacks (which try all possible combinations), side-channel attacks (which is a broader category), and fault injection (which introduces errors into the system to reveal information).