How much does the attacker learn from watching the system operate?
Covert channels are common in cryptosystems.
- Example: secure shell
- Example: Kerberos key management
Traffic analysis
- When is it used (time of day)
- From where to where
- Special circumstances associated with use
- Look for changes in operation
Countered by constant external behavior