Side-channel attack
A side-channel attack infers secret information from unintended physical or operational leakage produced by a system’s implementation rather than its intended outputs.
Hacking Cryptography
Side-channel analysis extracts information about secret computations from observable implementation behavior such as timing, power, or electromagnetic emissions.
- How it is used
- Guides cryptographic implementation review by connecting observable execution behavior to leakage of secret values.
- How deep it goes
- Explains power traces, timing leakage, processor behavior, and constant-time exponentiation, but defers advanced optimization details.
- Examples
- Uses RSA power traces, square-and-multiply for exponent 42, and C branch-prediction programs comparing branching with branchless execution.
- What you can do after
- Diagnose/debug secret-dependent timing and power leakage, then replace variable operation patterns with constant-time designs.
Read how Hacking Cryptography explains side-channel attack →
Real-World Cryptography
A side-channel attack infers secret-dependent information from physical or operational leakage such as timing, power consumption, or electromagnetic radiation.
- How it is used
- Frames cryptographic implementation as an adversarial engineering problem involving observable physical and operational leakage.
- How deep it goes
- Explains leakage mechanisms, demonstrates RSA power analysis, and gives software mitigations without detailing attack implementation.
- Examples
- Uses RSA square-and-multiply power traces, TLS padding errors, CPU caches, electromagnetic radiation, sound, and timing as examples.
- What you can do after
- Apply constant-time coding, secret-independent memory access, masking, blinding, uniform errors, and layered hardware defenses.
Read how Real-World Cryptography explains side-channel attack →
Secure APIs
A side-channel attack infers information about a system from inadvertently exposed characteristics of its operation rather than from its intended outputs.
- How it is used
- Uses response behavior to expose unintended information during API resource-access analysis.
- How deep it goes
- Defines side channels and explains timing-based resource enumeration, but does not develop attack automation.
- Examples
- Uses differing API latencies for existing and nonexistent resources as the concrete example.
- What you can do after
- Diagnose/debug with it by comparing endpoint latencies and applying consistent-response-time measures.
Related concepts
- timing attackincludes · A timing attack is a side-channel attack that infers information, often secret data, by measuring differences in the time taken to process inputs or perform computations.
- power analysisuses · Power analysis is a statistical method for estimating a test’s ability to detect an effect under specified assumptions, often to determine an appropriate sample size.
- constant-time programmingaddressed by · Constant-time programming is the practice of designing algorithms whose execution behavior does not depend on secret data or varying input values.
- API keyuses · An API key is a credential used to identify or authorize a client accessing an application programming interface.
These guides are generated from the text of Manning books by Manning's knowledge graph and link to the sections they draw on. The full books are available on liveBook and at manning.com.