# Questions tagged [timing-attack]

The side channel attack is based on the fact that the time difference between certain operations executed by the implementation of a cryptographic scheme allow an adversary to get information that he didn't have according to the theoretical specification of the scheme.

102 questions
Filter by
Sorted by
Tagged with
58 views

### Constant time empty string validation

Checks for null require an == check. If you have a string secret (say a hex-encoded key) and you want to check it's empty for validation should you compare it to <...
893 views

### Is If/else vulnerable to timing side-channel attacks?

I have a branching in c++: if (x & 1) { x = function_1(x); } else { x = function_2(x); } If function_1 and ...
• 969
53 views

### AES XEX Mode: Cache-attacks demonstrated?

Assume AES in XEX mode, so we encrypt a plaintext $x$ as $E_K[x \oplus k_1] \oplus k_2$ where $E_K$ is the usual AES Block cipher (assume $x$ is of block size). Assume the implementation of AES is ...
5k views

### How can I understand whether my C implementation is constant-time or not (i.e. resistant to timing attacks)

I have a code for polynomial multiplication and it is written in C. I heard that whether a particular instruction is "constant time" can vary by architecture and by processor model and there ...
• 859
1 vote
222 views

### Timing attacks: Symmetric vs Asymmetric Algorithms

There is a statement that I can't give a reference; "Since the timing characteristics of symmetric algorithms are not as key dependent as asymmetric algorithms, they are more resistant against ...
• 370
1 vote
73 views

### How is the Argon2d side channel attack performed?

How should the adversary behave in order to perform a successful side channel attack against Argon2d? I'm trying to understand the scenario that Argon2i tries to resist against.
• 529
122 views

### Chinese remainder theorem in ECDSA for parameters in secp256k1?

It is known that it is possible to apply the Chinese remainder theorem and attack RSA under precise conditions. https://tls.mbed.org/public/WSchindler-...
• 3
1 vote
92 views

### Why is implementation relevant to timing attacks?

Discussions from highly respected sources (details below) emphasize the importance of the implementation of cryptographic software to the effective security provided, with one particular case being ...
• 111
1 vote
93 views

### How feasible is it to guess the private key of libsodium by taking into account generation time?

So suppose you are doing this locally (so no network noise), and know the exact specifics of your processor too. Is it feasible to figure out the private key (while having access to the public-key) ...
• 647
142 views

### How to ensure that a cryptographic implementation is reasonably sound/robust?

I know from the bottom of my heart how bad the idea of custom-crypto is. I absolutely concur with the recommendation that it should only be done by professionals who specialize in implementing crypto ...
• 75
401 views

### Constant time comparison for arrays of different lengths

I found the following code snippet from the Bouncy Castle C# library, which seems to claim that it's constant time, even when the arrays have different lengths. ...
• 21
535 views

### Constant Time Multiplication for Cryptography in Pure Software without Hardware Multiplier or Barrel Shifter

To prevent various forms of timing side-channel attacks, it's strongly advisable to implementing public-key cryptography in constant time. Or at least, without secret-dependent timing variations. ...
• 91
68 views

### Is is safe to use MtEtM? (MAC-then-Encrypt and Encrypt-than-MAC)

Assuming I am using different secrets/keys for each MAC pass, does running both MtE and EtM creates any vulnerability? This is what I mean about doing MtEtM: ...
• 121
305 views

### Adapting RSA Timing Attack for Square And Multiply from right-to-left vs left-to-right

I'm trying to reconstruct the fairly well-known RSA timing attack by Kocher. I'm working with simulated timing data, so I have completely noise-free "measurements". My attack is successful ...
• 71
2k views

### Safely sorting secret data

Suppose you have a secret list of n distinct integers. How would you sort this list in a way that is not vulnerable to timing attacks? I tried looking up "...
• 145
366 views

### Is AES without T-Tables nor S-Box resistant to side-channel?

T-Tables and S-Boxes are prone to side-channel attacks, is an implementation without any lookup tables resistant to side-channel ? In this answer, https://crypto.stackexchange.com/a/63520/80926, the ...
110 views

### Can someone explain the timing attack on RSA with Montgomery multiplication?

I have read several articles on the temporal attack against Montgomery multiplication to speedup RSA computations. However, I do not quite get the principle. I understood that there is a additional ...
2k views

### How to confirm my implementation is constant time

I'm implementing Schnorr signatures following a variant used in Bitcoin Cash (BCH) of this algorithm: GitHub - Schnorr Signatures for secp256k1. A notable difference is that the BCH schnorr algorithm ...
• 99
385 views

### Mitigating timing attacks with a random sleep

Could you mitigate all timing attacks by putting a sleep(random()) with a naive crypto implementation? Eg if your implementation looks solid, but you're not sure what the next CPU cache vulnerability ...
• 133
380 views

### How to make an AES implementation using lookup tables immune to cache timing attacks?

I recently made a very naive implementation of AES using lookup tables, but it's totally unsafe because of timing attacks. I am not interested in using the processor specific instructions for AES, ...
• 908
1 vote
380 views

### Question about RSA timing attack and a Chosen Ciphertext Attack on RSA

I am quite new to the RSA and I have a couple of questions that confuse me. Q1: A Timing attack on RSA can be prevented _____________________________ A. By performing the “square and multiply” ...
• 11
44 views

### exfiltrating salts with timing attacks?

It seems to me that it's theoretically possible to exfiltrate a salt against a hashing algorithm that isn't constant time using specially crafted inputs. Are there any examples of this being done in ...
• 140
1 vote
119 views

### Side channel attack: Why building an eviction set is possible?

I'm learning about the side channel attack on the cache. I came to know that most of the attack (EVICT + TIME, PRIME + PROBE, PRIME + ABORT) on the cache is initiated by building an eviction set(a ...
53 views

### One time code appended to password

Apologies in advance, I'm a beginner and my knowledge of terminology in this field probably reflects that. I have a question about one-time codes being used with passwords. What inspires me to ask ...
61 views

### RSA: Blinding versus fixed-time computation

For RSA, what is the standard solution against timing attacks? I know about RSA blinding as one solution. Another solution is to always compute both the squared value and square-and-multiply values, ...
• 2,216
1k views

### The attacker model of the Lucky13 attack in TLS

Lucky13 is a timing attack against the MAC in the CBC MAC-then-encrypt ciphersuites. In the attack's page: The attacks involve detecting small differences in the time at which TLS error messages ...
• 367
1 vote
103 views

### obscuring timing attacks in vulnerable libraries

Let's say you're using a library that you know is vulnerable to timing attacks. Short of switching libraries all together it seems to me that putting a sleep in the ...
• 2,775
233 views

### Synthetic Jitter to Combat Timing Attacks

We are working on some tooling. It has a networking kernel. We would like to think that jitter built into the kernel would help with timing attacks? Is this true?
84 views

### Is timing attack practical in a web developer's perspective?

Let's say my server has a non-constant-time compare function for checking if the visitor has a valid session id. The time it takes for the comparator to run would be very insignificant, usually within ...
• 21
1 vote
42 views

### How does failing to square a value in this version libcrypt++ cause a timing attack vulnerability?

I'm a crypto beginner and reading about blinding, and my fundamental understanding about preventing timing attacks is that you need to sort of process information in a way that will produce similar ...
• 113
311 views

### GCM mode GHASH sensitivity to timing attacks

In GCM mode of authenticated encryption, is it a security concern if the GHASH implementation timing can vary? If the timing varies according to the AAD/ciphertext data, it looks as though that doesn'...
244 views

### Hashing items of different Bytes but same length would enable a timing attack?

I am following this paper which comes highly recommended as a secure Registration/Login system over TLS which uses client side computation for the Password Processing Function (PPF). What my main ...
1k views

### Constant time implementations of crypto algorithms

To protect against cache attacks (side channel attacks) generally constant time crypto implementations are advised. In some cases DJB released new algorithms (chacha) that are designed with this in ...
• 63
386 views

### AES cache-timing attacks and nonce-based operation modes

As I understand it, AES cache-timing attacks exploit the execution time variations due to cache hits/misses, especially the ones depending on the SBox look-up tables which are key-related. To mount ...
• 2,694
198 views

### should one worry about timing attacks with signature verification?

To compare two varablies in such a way that timing attacks don't exist it's generally recommended you pad the strings to the same length and then look at each byte, even if an earlier byte was ...
• 2,775
1k views

### Does this implementation of a function operate in constant time?

Suppose we have a function that takes $n$ parameters, each being one bit in size, and returns a single bit. Internally, this function has a bit string $N \in \{0, 1\}^{2^n}$ and it operates by using ...
• 3,407
454 views

### Does a conditional statement depending on a round number introduce timing attack problems?

In a cryptographic implementation I’m playing with, there’s a round function which includes a conditional if statement. Stripping the superfluous stuff, the C ...
• 17.4k
454 views

### Cache Timing Attack SHA-3

I’ve been tinkering with SHA-3 for a little bit, and I have some questions regarding the applicability of cache timing attacks on this particular hash function. The two sub functions that I believe ...
2k views

### Why don't table lookups run in constant time?

The Wikipedia article on big O notation says that performing a lookup is a constant time operation. So why are lookup tables susceptible to timing attacks?
• 3,407
556 views

### What are the implications of a non “constant time” implementations on trusted systems in a non-network scenario?

Assume a scenario where a symmetric encryption algorithm (for example: AES) wasn't implemented in a way it would safeguard against timing attacks. This symmetric encryption implementation is only used ...
• 17.4k
1k views

### RSA Timing Attack on "Extra" Montgomery Reduction

In "A practical implementation of the timing attack", the authors take advantage of a timing difference that stems from "extra reductions" that occur when multiplying numbers in the Montgomery form. ...
• 353
563 views

### Timing vulnerability of byte array equality test?

Would the following code to test MAC equality leak timing information ? ...
• 251
434 views

### Dilithium signature scheme and timing attacks – Does the running time actually depend on the secret key?

The paper “CRYSTALS – Dilithium: Digital Signatures from Module Lattices” (by Léo Ducas, Tancrède Lepoint, Vadim Lyubashevsky, Peter Schwabe, Gregor Seiler, and Damien Stehlé) introduces a digital ...
• 4,653
3k views

### Timing-Safety in JVM-Languages

How is it possible to write timing-safe code in JVM-languages (Java, Scala, Clojure...)? Is it possible to make libraries like BouncyCastle safe against timing-attacks? I know that even in C it is ...
• 580
127 views

### Does the timing of cycle-walking pose a threat?

Cycle-walking is a technique for format-preserving encryption that involves repeating an encryption process until the result is inside a desired range. For example, given an input P, a range R, and ...
• 2,347
1 vote
590 views

### Implementation of a side channel attack? [closed]

As homework I need to find the password of a crackme in ascii-coded binary. We were also given a specific part of the crackme (in the image below), which we will need to use a side channel attack ...
• 11
952 views

### Are lookup tables safe when they fit in a cache line?

The typical cache line size of modern x86 machines is 64 bytes. Is it safe to use lookup tables with secret data if the table does not exceed the cache line size, and is aligned accordingly? I was ...
• 2,216
156 views

### Is having AES tables on a distinct physical page enough to avoid cache timing attacks?

Reading about typical cache timing attacks, they seem to be based on intentional eviction of cache lines and timing how long an operation takes. It seems as if those attacks rely upon these tables ...
• 2,216