chore(brain): ASTRA 성장 자산 동기화 — 기능 인벤토리·growth(약점프로필/학습큐)·일화기억·장기기억·회의록 원문

2026-06-12 16:37:41 +09:00
parent a97fc7be07
commit 89fb05a28a
781 changed files with 138546 additions and 47 deletions
@@ -0,0 +1,192 @@
+---
+id: wiki-2026-0508-timing-attack
+title: Timing Attack
+category: 10_Wiki/Topics
+status: verified
+canonical_id: self
+aliases: [Timing Side Channel, Constant Time Comparison]
+duplicate_of: none
+source_trust_level: A
+confidence_score: 0.9
+verification_status: applied
+tags: [security, side-channel, cryptography, constant-time]
+raw_sources: []
+last_reinforced: 2026-05-10
+github_commit: pending
+tech_stack:
+  language: typescript
+  framework: nodejs
+---
+
+# Timing Attack
+
+## 매 한 줄
+> **"매 execution time 의 secret-dependent variation 의 leak"**. 1996 Kocher RSA timing paper origin — comparison/branch/cache 가 secret bit 에 dependent 면 attacker 가 multiple measurement 의 statistical analysis 로 secret 을 추출. Mitigation 의 핵심: constant-time code.
+
+## 매 핵심
+
+### 매 Vulnerable patterns
+- **Early-exit string compare**: `==` / `strcmp` returns on first mismatch byte.
+- **Secret-dependent branch**: `if (key[i] == 0)` 의 cache miss timing differs.
+- **Secret-dependent table lookup**: AES S-box → cache line timing.
+- **Modular exponentiation**: square-and-multiply 의 bit-dependent ops.
+
+### 매 Mitigation
+- **Constant-time compare**: scan all bytes regardless, XOR-accumulate.
+- **No secret-dependent branches**: use bitwise mask instead.
+- **No secret-dependent indices**: scan full table or use bit-slicing.
+- **Blinding**: randomize input (RSA: blind w/ random r, decrypt, unblind).
+
+### 매 응용
+1. HMAC token comparison (auth bypass via timing).
+2. Password hash compare (after bcrypt — still need constant-time).
+3. JWT signature verify.
+
+## 💻 패턴
+
+### Vulnerable: early-exit compare
+```typescript
+// ❌ DON'T — leaks prefix length
+function badCompare(a: string, b: string): boolean {
+  if (a.length !== b.length) return false;
+  for (let i = 0; i < a.length; i++) {
+    if (a[i] !== b[i]) return false;  // early exit reveals match length
+  }
+  return true;
+}
+// Attacker measures: "aaaa" vs "baaa" faster than "aaaa" vs "aaab"
+```
+
+### Constant-time compare (Node.js)
+```typescript
+import { timingSafeEqual } from 'node:crypto';
+
+function safeCompare(a: string, b: string): boolean {
+  const bufA = Buffer.from(a);
+  const bufB = Buffer.from(b);
+  if (bufA.length !== bufB.length) {
+    // length leak unavoidable — pad to fixed length OR accept
+    timingSafeEqual(bufA, bufA); // dummy compare to equalize timing
+    return false;
+  }
+  return timingSafeEqual(bufA, bufB);
+}
+
+// HMAC token check
+import { createHmac } from 'node:crypto';
+function verifyToken(token: string, payload: string, secret: string): boolean {
+  const expected = createHmac('sha256', secret).update(payload).digest('hex');
+  return expected.length === token.length &&
+         timingSafeEqual(Buffer.from(expected), Buffer.from(token));
+}
+```
+
+### Browser: SubtleCrypto + manual constant-time
+```typescript
+// Web Crypto has no timingSafeEqual — implement carefully
+function ctEqualBytes(a: Uint8Array, b: Uint8Array): boolean {
+  if (a.length !== b.length) return false;
+  let diff = 0;
+  for (let i = 0; i < a.length; i++) {
+    diff |= a[i] ^ b[i];     // XOR-accumulate, no branch
+  }
+  return diff === 0;
+}
+
+async function verifyHmac(msg: string, sig: ArrayBuffer, key: CryptoKey) {
+  const computed = await crypto.subtle.sign(
+    'HMAC', key, new TextEncoder().encode(msg)
+  );
+  return ctEqualBytes(new Uint8Array(computed), new Uint8Array(sig));
+}
+```
+
+### Python constant-time compare
+```python
+import hmac
+
+def verify(token: str, expected: str) -> bool:
+    return hmac.compare_digest(token, expected)
+
+# bcrypt — already constant-time via library
+import bcrypt
+def check_password(plain: bytes, hashed: bytes) -> bool:
+    return bcrypt.checkpw(plain, hashed)  # safe internally
+```
+
+### Go constant-time
+```go
+import "crypto/subtle"
+
+func verify(a, b []byte) bool {
+    return subtle.ConstantTimeCompare(a, b) == 1
+}
+
+// Conditional copy without branch
+func ctSelect(cond int, a, b []byte) {
+    subtle.ConstantTimeCopy(cond, a, b)
+}
+```
+
+### Branchless conditional (C-style)
+```typescript
+// Constant-time conditional select
+function ctSelect(cond: number, a: number, b: number): number {
+  // cond must be 0 or 1
+  const mask = -cond;          // 0 or 0xFFFFFFFF
+  return (a & mask) | (b & ~mask);
+}
+
+// Constant-time min/max without branch
+function ctMin(a: number, b: number): number {
+  const lt = (a - b) >>> 31;   // 1 if a<b
+  return ctSelect(lt, a, b);
+}
+```
+
+### Remote timing (network attacks)
+```text
+Lucky 13 (TLS 2013): MAC verify timing leaked plaintext.
+CRIME / BREACH: compression length leaked secrets (different side channel).
+
+Mitigation:
+  - Always run full computation regardless of input validity.
+  - Add randomized delay (debatable — may not help, can hurt).
+  - Rate-limit + monitoring for anomalous timing-probe traffic.
+```
+
+## 매 결정 기준
+| 상황 | Approach |
+|---|---|
+| Password hash check | bcrypt/argon2 lib (already CT) |
+| HMAC/token compare | timingSafeEqual / hmac.compare_digest |
+| AES on untrusted host | AES-NI (HW) or bit-sliced soft impl |
+| Secret-dependent index | bitwise mask or full-table scan |
+| RSA/ECDSA private op | use vetted lib (BoringSSL, libsodium) — never roll your own |
+
+**기본값**: never write your own crypto compare. Use language stdlib `timingSafeEqual` / `compare_digest` / `subtle.ConstantTimeCompare`.
+
+## 🔗 Graph
+- 부모: [[Side Channel Attack]] · [[Practical-Cryptography|Cryptography]]
+- 변형: [[Spectre]] · [[Cache Timing Attack]] · [[Power Analysis]]
+
+## 🤖 LLM 활용
+**언제**: auth code review, HMAC/token compare, custom crypto routines, security audit.
+**언제 X**: high-level app logic where no secrets are compared (UI rendering, business rules).
+
+## ❌ 안티패턴
+- **`a === b` for secrets**: V8/JIT may early-exit, branch, or short-circuit.
+- **Custom "constant-time" without testing**: compiler can re-introduce branches via optimization. Test with `dudect`.
+- **Throwing on mismatch**: exception path differs in timing from success path.
+- **Logging mismatch position**: leaks comparison index.
+- **Comparing hashes in DB**: even hash compare 의 leaks length prefix → use CT.
+
+## 🧪 검증 / 중복
+- Verified (Kocher 1996 paper, Node.js crypto docs, Go subtle pkg, OWASP Cryptographic Storage CS).
+- 신뢰도 A.
+
+## 🕓 Changelog
+| 날짜 | 변경 |
+|---|---|
+| 2026-05-08 | Phase 1 |
+| 2026-05-10 | Manual cleanup — full canonical (CT compare + branchless + Node/Go/Python + remote attacks) |