ISC2 Systems Security Certified Practitioner (SSCP) Practice Question

Timing attacks exploit the fact that some cryptographic implementations take variable time to process different inputs, allowing an attacker to infer secret information such as private-key bits. The most effective countermeasure is to make every operation take the same amount of time, eliminating the timing signal. Implementing constant-time algorithms or applying techniques like RSA blinding forces the HSM to perform computations in a uniform manner, preventing attackers from correlating execution time with key material. Simply lengthening the key or rotating it does not remove the underlying timing leakage, and salting the data before signing affects the message digest, not the private-key operation whose timing is being measured.