Created
April 12, 2020 06:47
-
-
Save RaminMammadzada/7b24707d692ce628ec886e60e4afba3b to your computer and use it in GitHub Desktop.
Timing Attack for 4 digits password
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
""" | |
The function check_password(password) is used by a safe with 4-digits passwords, and is | |
susceptible to timing attacks. More specifically, it takes it around 0.1 seconds to check | |
one digit – so brute-forcing all the possible combinations will take around 1,500 hours. | |
Can you implement a way to crack its password in less than a minute? | |
""" | |
import time | |
import sys # ignore | |
sys.path.insert(0,'.') # ignore | |
from pswd import real_password | |
def check_password(password): # Don't change it | |
if len(password) != len(real_password): | |
return False | |
for x, y in zip(password, real_password): | |
time.sleep(0.1) # Simulates the wait time of the safe's mechanism | |
if int(x) != int(y): | |
return False | |
return True | |
def crack_password(): | |
password = "" | |
inp = "" | |
# loop for every element in the password, in this case there are 4 elements in the password | |
# before running this cracking code, we need to find how many elements does the password composed of | |
for turn in range(4): | |
print("- - -" + str(turn) + "- - -" ) | |
# loop for finding the correct char | |
for char in "0123456789": | |
inp = password + char | |
inp += "0"*(4-len(inp)) | |
print(inp) | |
t1 = int(round(time.time() * 1000)) | |
if (not check_password(inp)): | |
# this will work for every char for each turn of the password untill the last turn of the loop inside the check_password() function | |
t2 = int(round(time.time() * 1000)) | |
elapsedTime = round((t2 - t1)/100) * 100 # in order to get round milliseconds elapsed | |
if( elapsedTime > 100*(turn+1) ): | |
print(str(turn+1) + " th digit: " + char + ">>>" +str(elapsedTime)) | |
password += char | |
break | |
else: | |
# This else work when the last correct char is found. Therefore, last char will be added here and break the for loop | |
password += char | |
print("All password: " + password) | |
break | |
inp = "" | |
return password | |
# this function is not used, I used times (*) functionaly istead of this, for example: "0"*(4-len(inp)) | |
def printCustomNumberOfChar(char, count): | |
var = "" | |
for e in range(count): | |
var += char | |
return var |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment