Side channel timing attack mitigation in securing data in transit

A streaming decryption data processing system comprising:

• a host computer comprising memory and at least one processor;
• a decryption process executing in the memory of the host computer and performing decryption of input streams;
• and,
• a side-channel attack mitigation module comprising computer program code executing in the memory of the host computer, the program code during execution causing the processor to perform operations comprising:
• reading an input stream into the decryption process;
• extracting from the input stream:
• an encryption envelope having a wrapped key;
• a cipher text;
• and
• a first message authentication code (MAC);
• generating a second MAC using the wrapped key of the encryption envelope;
• and,
• performing decryption of the cipher text in constant time by:
• determining whether the encryption envelope is authentic by comparing the first MAC extracted from the encryption envelope and the second MAC generated using the wrapped key;
• when the encryption envelope is authentic, generating an authenticated decryption of the cipher text using the wrapped key of the encryption envelope;
• and
• wherein performing decryption of the cipher text in constant time indicates whether the wrapped key is an actual key that generated the cipher text of the encryption envelope.