It seems to me that it's theoretically possible to exfiltrate a salt against a hashing algorithm that isn't constant time using specially crafted inputs.

Are there any examples of this being done in a reasonable time?

  • $\begingroup$ Could you provide where you get this sense? A well-crafted coding can mitigate against timing attack up some level. $\endgroup$ – kelalaka Nov 11 at 7:46
  • $\begingroup$ Exfiltrate implies that you have access to information from the inside and are trying to get that information to someone on the outside via some hidden channel. Any data you have knowledge of can can be exfiltrated, provided that the channel has sufficient bandwidth. Timing attacks don't strictly require an insider. $\endgroup$ – Future Security Nov 11 at 15:59
  • $\begingroup$ Usually a salt is assumed to be public knowledge anyway. That said, most ‘hash functions’ that involve a salt tend to invite implementations that are naturally resistant to timing side channels, so…the answer is likely ‘no’, though it may be hard to prove a negative or to support it with citations. $\endgroup$ – Squeamish Ossifrage Nov 11 at 21:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.