Cybersecurity glossary
What is a Side-Channel Attack?
Learn what side-channel attacks are, how timing, power, electromagnetic, and cache leaks reveal secrets, famous examples like Spectre, and how to mitigate side channels in software and hardware.
Definition
A side-channel attack extracts sensitive information by observing indirect effects of computation—such as timing, power consumption, cache behavior, electromagnetic emissions, or acoustic signals—rather than by breaking cryptographic algorithms mathematically.
Why side channels matter
Cryptography can be mathematically strong and still leak in practice. Real systems consume power, fill caches, take variable time, and emit EM noise. Attackers who measure those effects can recover keys, passwords, or cross-tenant data.
Side-channel attacks span lab power analysis against smart cards and remote timing attacks against web login endpoints.
Major side-channel classes
Timing
Secret-dependent branches or comparisons change response latency.
Cache / microarch
Shared CPU caches reveal access patterns across processes or VMs.
Power / EM
Electrical and electromagnetic traces correlate with key bits.
Acoustic / other
Sounds, temperature, or fault effects can also leak information.
How a typical software timing leak works
Secret influences control flow
Code branches or exits early based on password or MAC bytes.
Attacker measures latency
Remote or local timing distinguishes correct vs incorrect guesses.
Guesses refine byte by byte
Statistical analysis recovers the secret without breaking the algorithm.
Full secret recovered
Keys, tokens, or passwords become usable for further compromise.
Mitigation approaches
| Domain | Mitigations |
|---|---|
| Crypto software | Constant-time libraries; avoid custom crypto |
| Web apps | Uniform auth errors; rate limits; careful comparison APIs |
| OS / CPU | Vendor microcode, kernel mitigations, isolation features |
| Hardware tokens | Shielding, masking, certified secure elements |
- Use vetted constant-time cryptographic libraries—do not roll your own.
- Avoid secret-dependent branches and table lookups in security-critical code.
- Return uniform error messages and timings for authentication failures where practical.
- Keep firmware, microcode, and hypervisor patches current for speculative-execution issues.
- Isolate high-value workloads when sharing hardware with untrusted tenants.
- Include timing and oracle testing in cryptographic and auth reviews.
- Prefer hardware with evaluated side-channel resistance for payment and HSM use cases.
- Treat 'algorithm is strong' as necessary but not sufficient.
The practical takeaway
A side-channel attack reads secrets from how computation looks from the outside—time, power, caches, and more. Strong algorithms need leak-resistant implementations and updated platforms.
If your defense assumes attackers only see inputs and outputs, you are missing half the threat model.
Related security terms
Frequently asked questions
What is a side-channel attack in simple terms?
Instead of cracking the math, attackers watch how the system behaves—how long operations take, how caches change, or how much power is used—to infer secrets.
Are side channels only a hardware problem?
No. Software timing differences, error messages, and compression behavior can leak data without special lab equipment.
What are Spectre and Meltdown?
They are famous microarchitectural side-channel classes that abuse speculative execution and related CPU features to leak memory across security boundaries.
What is a constant-time implementation?
Cryptographic code that avoids secret-dependent branches and memory accesses so execution time does not reveal key bits.
Can WAFs stop side-channel attacks?
Generally no. Side channels are about physical or microarchitectural leakage, not typical HTTP payload filtering.
How do developers mitigate software side channels?
Use constant-time crypto libraries, avoid secret-dependent control flow, standardize error responses, and keep dependencies patched for known CPU/OS mitigations.
References
Explore authoritative guidance and frameworks related to side-channel attack.
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.