Module sampler 

Collects raw response-time measurements.

Key methodology requirement: request classes (e.g. “correct prefix” / “wrong prefix”) must be interleaved in random order, not sent block by block (“all A, then all B”) — otherwise server warm-up, background load, or network drift over time bias the result, not the leak itself. See the dudect / Crosby-Wallach methodology.

Structs

HttpTarget

HTTP target: the URL, the point where the test value gets injected, and any static headers sent unchanged on every request (auth headers, CSRF tokens, session cookies — whatever the endpoint needs to reach the code path under test at all, distinct from the value being injected and measured).

PlainSamples

Result of a plain measurement pass for sidecheck doctor — no class split, we only care about the shape of the RTT distribution to the target.

RawSamples

Enums

InjectionPoint

Where the test value gets injected. Header is the most common case for API keys, Query for legacy endpoints with a token in the URL, JsonBody for typical JSON logins (POST /login {“password”: “…”}).

Functions

collect_plain

Collects n consecutive measurements of the same request. Unlike run_interleaved, it doesn’t abort on packet loss — it just counts it: in doctor mode, the loss rate itself is part of the diagnosis, not a reason to stop.

random_wrong_value

Generates a deliberately wrong value of the same length as the real secret — so payload length isn’t a separate variable skewing the measurement (see the CLI warning about mismatched value_a/value_b length). Takes an external RNG so the whole run is reproducible from one seed.

run_interleaved

Runs n_per_class measurements for each class, interleaving them in random blocks to average out drift over time. Isolated network failures don’t abort the whole run — they’re counted and reported separately, but if the failure ratio exceeds max_failure_ratio, the run stops: timings can’t be trusted over such an unstable channel.