Local_Timing_Attack.cs

using System;
using System.Collections.Generic;
using System.Linq;
using System.Text;
using System.Threading.Tasks;
using System.Diagnostics;
using System.IO;

namespace TimingAttack
{
    class Program
    {
        //a valid, csprng generated 88 character string (64 bits)
        static string valid_token = "qCXQ8v73jv8L2m/YXOfWB55mJzDubC0s51r3nHqLsBFTlaPTO8vBDcLJVs/Rt8j4VjiA3VDUMy8gK+eagU9JVw==";

        static void Main(string[] args)
        {

            Stopwatch sw = new Stopwatch();
            //this is a "warm up", for some reason the first iteration is always MUCh higher, we're just going to throw these numbers away
            List<Int64> times = new List<Int64>();
            for (int i = 0; i < 1000; i++)
            {
                sw.Reset();
                sw.Start();
                CheckToken(valid_token);
                sw.Stop();
                times.Add(sw.ElapsedTicks);
            }

            
            List<Int64> correctTimes = new List<Int64>();
            List<Int64> badTimes = new List<Int64>();
            string csv = "Length,correct time,incorrect time\r\n";
            for (int i = 1; i < 88; i++)
            {
                string correctTest = valid_token.Substring(0, i);
                correctTest = correctTest.PadRight(88);
                string wrongString = "";
                while (true)
                {
                    wrongString = BuildWrongString(i);
                    if (wrongString != correctTest) break;
                }
                wrongString = wrongString.PadRight(88);
                for(int j=0;j<200;j++)
                {
                    //good
                    sw.Reset();
                    sw.Start();
                    CheckToken(correctTest);
                    sw.Stop();
                    correctTimes.Add(sw.ElapsedTicks);
                    //bad
                    sw.Reset();
                    sw.Start();
                    CheckToken(wrongString);
                    sw.Stop();
                    badTimes.Add(sw.ElapsedTicks);
                }
                csv = csv + String.Format("{0},{1},{2}\r\n", i, correctTimes.Average(), badTimes.Average());
                correctTimes.Clear();
                badTimes.Clear();
            }
            //write csv to file
            string mydocpath = Environment.GetFolderPath(Environment.SpecialFolder.MyDocuments);
            using (StreamWriter outputFile = new StreamWriter(mydocpath + @"\TimingAttack.csv"))
            {
                outputFile.WriteLine(csv);
            }
            
        }


        public static bool CheckToken(string token)
        {
            var validBytes = Encoding.ASCII.GetBytes(valid_token);
            var testBytes = Encoding.ASCII.GetBytes(token);
            for(int i = 0; i< validBytes.Length; i++)
            {
                if(validBytes[i] != testBytes[i])
                {
                    return false;
                }
            }
            return true;
        }

        static string BuildWrongString(int length)
        {
            char[] base64chars = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz123456789/+=".ToCharArray();
            Random rnd = new Random();
            string wrongString = "";
            for(int i=0;i<length;i++)
            {
                wrongString = wrongString + base64chars[rnd.Next(0, base64chars.Length)];
            }
            return wrongString;
        }
    }
}