I know this is a difficult subject but would a good defense against timing attacks be not sending a message if the decryption or authentication fails? So if the attacker provides a wrong HMAC for example and this is compared and found to be false you simply return nothing to the attacker (this is considering a network environment though i do not want to limit it to a network environment)
Are there other ways to defend against timing attacks? I've found papers like this (free PDF) and this (free PDF). The later one seems to be a proposal to change AES to help it prevent feasibility of timing attacks, I don't think I should just go ahead and implement it my self.
All these papers are great but they are such a long read and to be honest sometimes they just loose me. So are there any real life implementation examples against timing attacks? I'd prefer these examples to work on any cipher but cipher specific would be good as well.
I should note I've found some answers on this topic: like this one AES-timing-attacks but again the answer (as it is everywhere) is: take the worst possible time and make it last that long. this, for implementations, just isn't a feasible way to go is it?
- is simply not returning a message when something failed to decrypt or authenticate a viable option?
- are there other good implementations against timing attacks.