It seems to me that it's theoretically possible to exfiltrate a salt against a hashing algorithm that isn't constant time using specially crafted inputs.

Are there any examples of this being done in a reasonable time?

  • $\begingroup$ Could you provide where you get this sense? A well-crafted coding can mitigate against timing attack up some level. $\endgroup$
    – kelalaka
    Commented Nov 11, 2019 at 7:46
  • $\begingroup$ Exfiltrate implies that you have access to information from the inside and are trying to get that information to someone on the outside via some hidden channel. Any data you have knowledge of can can be exfiltrated, provided that the channel has sufficient bandwidth. Timing attacks don't strictly require an insider. $\endgroup$ Commented Nov 11, 2019 at 15:59
  • $\begingroup$ Usually a salt is assumed to be public knowledge anyway. That said, most ‘hash functions’ that involve a salt tend to invite implementations that are naturally resistant to timing side channels, so…the answer is likely ‘no’, though it may be hard to prove a negative or to support it with citations. $\endgroup$ Commented Nov 11, 2019 at 21:14


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.