We are working on some tooling. It has a networking kernel. We would like to think that jitter built into the kernel would help with timing attacks?
Is this true?
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It only takes a minute to sign up.Sign up to join this community
Yes, and no.
Adding random jitter makes things harder, but since you cannot force the device to go faster then the minimum number of instructions it would take to perform the computation without interrupts, it would still be possible to perform a timing attack using a large number of traces and statistical tools such as low percentile filters, in a similar way as in this paper by Crosby et al.
In the end, the only reliable way to fight timing attacks is really to have constant time code. You can read more about constant time crypto on BearSSL's website.
But you can encrypt all the data you're sending over the network, using constant time crypto and that's it. No need to have the whole network stack constant time, if it's only sending encrypted data!