What is a side-channel attack that retrieves sensitive information by measuring the response time of the server?

What is a side-channel attack that retrieves sensitive information by measuring the response time of the server?

• A. Cookies
• B. web-based timing attack
• C. Direct Timing Attack
• D. Cross-site Timing Attack

Answer: (B)

Timing side-channel attacks exploit differences in how long operations take to reveal secrets. In a web context, an attacker sends requests and measures the server’s response times, using the latency differences to infer information processed by the server (such as whether a username exists or how far a check has progressed). This specific approach, done over HTTP to a web server, is called a web-based timing attack. Cookies are just data stored by the browser, not an attack method. A Direct Timing Attack targets timing of a cryptographic operation itself, usually in a local or hardware context. A Cross-site Timing Attack implies timing analysis across origins, which isn’t required here. So the best description is a web-based timing attack.

Timing side-channel attacks exploit differences in how long operations take to reveal secrets. In a web context, an attacker sends requests and measures the server’s response times, using the latency differences to infer information processed by the server (such as whether a username exists or how far a check has progressed). This specific approach, done over HTTP to a web server, is called a web-based timing attack. Cookies are just data stored by the browser, not an attack method. A Direct Timing Attack targets timing of a cryptographic operation itself, usually in a local or hardware context. A Cross-site Timing Attack implies timing analysis across origins, which isn’t required here. So the best description is a web-based timing attack.