So there's a PHP package that's been recently written to protect against cache timing attacks:


My question is... just how exploitable are cache timing attacks?

My overall impression is that they're extremely difficult to exploit and attempting to protect against them is rather like using a 1MB two-prime RSA key instead of a 2KB two-prime RSA key to protect against factorization - that it is unnecessary and impractical

  • 2
    $\begingroup$ Well, the attack scenario is already quite restrictive: You have to sit on the same CPU as your victim for the attack to work... $\endgroup$ – SEJPM Mar 12 '16 at 15:22
  • 2
    $\begingroup$ @SEJPM It's of course a good question if you should consider that "quite restrictive" in the age of people running VM's in the cloud... Share and enjoy :) I'd of course question any code that uses base 32 or base 64 to encode secret values in the first place (before wrapping them). $\endgroup$ – Maarten Bodewes Mar 12 '16 at 15:45
  • $\begingroup$ @SEJPM Have you ever kept a browser tab with javascript enabled open for several days? Then you may be vulnerable to this javascript-based cache attack $\endgroup$ – raptortech97 Mar 12 '16 at 19:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.