a side-channel attack
Suppose a safe's combination is unknowable from the front, but you notice that the lock clicks a little louder on the correct digit, or the dial gets warm where the right numbers are. You never broke the lock; you read a secret from an unintended 'side' signal it gave off. A side-channel attack is exactly this against a computer: instead of attacking the algorithm head-on, it learns a secret from a physical byproduct of the computation — how long it took, how much power it drew, what sounds or electromagnetic waves it emitted, or what state it left in a shared cache.
The reason these work is that real hardware's behaviour quietly depends on the data it processes, even when the official output reveals nothing. A naive password check that returns 'wrong' the instant it hits the first mismatching character takes a hair longer for a password that matches more leading characters — so by timing many guesses, an attacker can recover the password one character at a time, without ever seeing it. Power is even richer: the energy a chip burns can depend on whether a key bit is 0 or 1, so measuring the power trace during encryption can extract a cryptographic key. Cache state is the most important channel in modern CPUs: whether a secret-dependent address was cached changes the timing of later accesses (see cache-timing-attack).
Honestly, side channels are a deep and humbling class of threat because they bypass the usual logic of security. A cipher can be mathematically unbreakable and still leak its key through power or timing, because the math assumes an idealized machine and the attack exploits the messy physical one. Defenses aim to make the byproduct independent of the secret — constant-time code that always does the same work regardless of data, blinding, adding noise, or partitioning shared resources — but each costs performance, and proving a real system leaks nothing is genuinely hard. Spectre and Meltdown are side-channel attacks of exactly this family, using cache timing as the channel (see microarchitectural-security).
A login check compares the entered password to the real one character by character and returns 'no' the moment a character differs. The guess 'aXXXXX' is rejected slightly faster than 'pXXXXX' if the real password starts with 'p'. By timing thousands of guesses, an attacker finds the first character (the slowest rejection), then the second, and so on — recovering the whole password through timing alone, never reading it.
An early-exit comparison leaks through timing; constant-time code that always compares every character closes this channel.
A cryptographic algorithm can be provably secure on paper and still leak its key through a side channel, because the proof assumes an ideal machine while the attack measures the real one. Mathematical secrecy and physical secrecy are not the same thing.