{"id":51578745,"url":"https://github.com/systemslibrarian/crypto-lab-timing-sidechannel","last_synced_at":"2026-07-11T03:32:25.002Z","repository":{"id":368055325,"uuid":"1283206587","full_name":"systemslibrarian/crypto-lab-timing-sidechannel","owner":"systemslibrarian","description":null,"archived":false,"fork":false,"pushed_at":"2026-06-28T22:04:59.000Z","size":76,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2026-06-28T22:23:56.824Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"TypeScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/systemslibrarian.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2026-06-28T17:01:41.000Z","updated_at":"2026-06-28T22:05:02.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/systemslibrarian/crypto-lab-timing-sidechannel","commit_stats":null,"previous_names":["systemslibrarian/crypto-lab-timing-sidechannel"],"tags_count":null,"template":false,"template_full_name":null,"purl":"pkg:github/systemslibrarian/crypto-lab-timing-sidechannel","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/systemslibrarian%2Fcrypto-lab-timing-sidechannel","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/systemslibrarian%2Fcrypto-lab-timing-sidechannel/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/systemslibrarian%2Fcrypto-lab-timing-sidechannel/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/systemslibrarian%2Fcrypto-lab-timing-sidechannel/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/systemslibrarian","download_url":"https://codeload.github.com/systemslibrarian/crypto-lab-timing-sidechannel/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/systemslibrarian%2Fcrypto-lab-timing-sidechannel/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":35350133,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-26T15:22:16.424Z","status":"online","status_checked_at":"2026-07-11T02:00:05.354Z","response_time":104,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2026-07-11T03:32:24.267Z","updated_at":"2026-07-11T03:32:24.996Z","avatar_url":"https://github.com/systemslibrarian.png","language":"TypeScript","funding_links":[],"categories":[],"sub_categories":[],"readme":"# crypto-lab-timing-sidechannel\n\n## What It Is\n\n`crypto-lab-timing-sidechannel` is a browser demo of a timing side-channel attack\nagainst a non-constant-time secret comparison. It pairs a **vulnerable** comparison\nthat returns on the first mismatched byte with a **constant-time** comparison that\nalways examines the full width, and then lets you act as the attacker: a random\nsecret is generated in memory, hidden from the attack code, and recovered one\ncharacter at a time using nothing but measured execution time. The cryptographic\nsubject is constant-time comparison itself — the building block used to verify MACs,\npassword hashes, and tokens — under a side-channel threat model where the attacker\nobserves timing rather than output. It is an educational demonstration, not a\nproduction library.\n\n## When to Use It\n\n- Use it to teach *why* constant-time comparison is mandatory for secrets, because it\n  turns an abstract warning into a secret you watch get extracted from timing alone.\n- Use it in secure-coding workshops alongside `crypto-lab-timing-oracle`, because this\n  lab goes deep on the attacker's statistical recovery while that one tours where\n  leaks live across several primitives.\n- Use it to motivate code review rules against `==`/`memcmp` on secrets, because the\n  early-exit pattern it attacks is exactly the one those rules forbid.\n- Do NOT use it as a constant-time library, because the \"constant-time\" comparator\n  here is the correct source-level pattern, not an engine-level guarantee in a JS JIT.\n- Do NOT read a noisy \"partial recovery\" run as proof of safety, because the same leak\n  recovers in full with more measurements or a precise timer.\n\n## Live Demo\n\n**[systemslibrarian.github.io/crypto-lab-timing-sidechannel](https://systemslibrarian.github.io/crypto-lab-timing-sidechannel/)**\n\nGenerate a fresh hidden secret, choose the target (vulnerable or constant-time) and\nthe timing channel (live `performance.now()` or an idealised noise-free operation\ncount), then launch the attack and watch each character resolve in an animated bar\nchart as the recovered string fills in — with a per-position \"why this character won\"\nexplanation. Section 2 lets you measure both implementations against your own demo\nsecret and guess, and sweep every matching-prefix length to plot the rising\nvulnerable curve against the flat constant-time line. A one-click \"run all four\nmodes\" board proves the same secret is recovered only when the implementation leaks,\nand that the idealised channel matches the live one in shape. Controls include the\ntarget implementation, the timing channel, the number of measurements per byte, and a\n\"New secret\" button. There is no encrypt/decrypt — the demo is about how a comparison\nleaks, not about a cipher.\n\n## How to Run Locally\n\n```bash\ngit clone https://github.com/systemslibrarian/crypto-lab-timing-sidechannel\ncd crypto-lab-timing-sidechannel\nnpm install\nnpm run dev\n```\n\nThere are no environment variables. `npm test` runs the Vitest suite (comparison\nprimitives, the recovery engine against deterministic oracles, statistics, and a\nhappy-dom + axe UI integration test); `npm run build` type-checks and produces `dist/`.\n\n## Part of the Crypto-Lab Suite\n\n\u003e One of 60+ live browser demos at\n\u003e [systemslibrarian.github.io/crypto-lab](https://systemslibrarian.github.io/crypto-lab/)\n\u003e — spanning Atbash (600 BCE) through NIST FIPS 203/204/205 (2024).\n\n---\n\n*\"Whether you eat or drink, or whatever you do, do all to the glory of God.\" — 1 Corinthians 10:31*\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsystemslibrarian%2Fcrypto-lab-timing-sidechannel","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fsystemslibrarian%2Fcrypto-lab-timing-sidechannel","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsystemslibrarian%2Fcrypto-lab-timing-sidechannel/lists"}