The Pin That Binds First Tells You Everything

Pin three binds first on my practice lock. Not because pin three is special, but because somewhere in a Chinese factory, a machinist’s tolerance wandered a few microns from spec. That variance creates a side channel. Under tension, the plug rotates infinitesimally until one pin — the one with the tightest fit — catches on the shear line. You feel it resist. You lift it. Now pin one binds. The lock is telling you its secrets, one pin at a time.

Paul Kocher’s 1996 paper on timing attacks describes the same vulnerability in software. When your code compares a password like this:

func insecureCompare(_ input: String, _ secret: String) -> Bool {
    guard input.utf8.count == secret.utf8.count else { return false }
    for (a, b) in zip(input.utf8, secret.utf8) {
        if a != b { return false }  // Bails early — leaks timing
    }
    return true
}

…it bails at the first mismatched character. An attacker can measure response times: “sXXXXX” fails faster than “seXXXX” because the first version exits on character one, the second on character two. Given enough samples, each byte reveals itself. The lock — the algorithm — is telling its secrets, one character at a time.

The fix is to deny the attacker that feedback. Check everything, regardless of where mismatches occur:

func timingSafeCompare(_ a: String, _ b: String) -> Bool {
    guard a.utf8.count == b.utf8.count else { return false }
    var result: UInt8 = 0
    for (c1, c2) in zip(a.utf8, b.utf8) {
        result |= c1 ^ c2  // Accumulates difference bits without branching
    }
    return result == 0
}

Perl, naturally, has its own idiom for this — though you wouldn’t guess it from the line noise:

sub timing_safe_eq {
    my ($a, $b) = @_;
    return 0 if length($a) != length($b);
    my $diff = 0;
    $diff |= ord(substr($a, $_, 1)) ^ ord(substr($b, $_, 1)) for 0 .. length($a) - 1;
    return $diff == 0;
}

print timing_safe_eq("secret", "secret") ? "match\n" : "nope\n";  # match
print timing_safe_eq("secret", "secrat") ? "match\n" : "nope\n";  # nope

The XOR-and-OR accumulation pattern appears in OpenSSL, libsodium, and every serious cryptographic library written since Kocher’s paper made the problem undeniable. The Swift version compiles to branchless assembly on most platforms. The Perl version… probably doesn’t, but the timing difference between iterations is swamped by the interpreter overhead anyway.

A locksmith could machine every pin chamber to identical tolerances. But then you’d need the exact key — no feedback, no picking. The lock would be secure but also unforgiving. No bypass possible, not even by the owner who forgot their key.

Most software takes the easier path: consistent tolerances in code are cheap. But I’m keeping my practice lock with its sloppy pins. It teaches better than a perfect one would.