Questions tagged [timing-attack]

side channel attack based on the different speed at which certain operations are executed.

Filter by
Sorted by
Tagged with
1
vote
0answers
27 views

Side channel attack: Why building an eviction set is possible?

I'm learning about the side channel attack on the cache. I came to know that most of the attack (EVICT + TIME, PRIME + PROBE, PRIME + ABORT) on the cache is initiated by building an eviction set(a ...
0
votes
0answers
31 views

One time code appended to password

Apologies in advance, I'm a beginner and my knowledge of terminology in this field probably reflects that. I have a question about one-time codes being used with passwords. What inspires me to ask ...
2
votes
0answers
34 views

RSA: Blinding versus fixed-time computation

For RSA, what is the standard solution against timing attacks? I know about RSA blinding as one solution. Another solution is to always compute both the squared value and square-and-multiply values, ...
2
votes
2answers
647 views

The attacker model of the Lucky13 attack in TLS

Lucky13 is a timing attack against the MAC in the CBC MAC-then-encrypt ciphersuites. In the attack's page: The attacks involve detecting small differences in the time at which TLS error messages ...
1
vote
1answer
67 views

obscuring timing attacks in vulnerable libraries

Let's say you're using a library that you know is vulnerable to timing attacks. Short of switching libraries all together it seems to me that putting a sleep in the ...
2
votes
0answers
55 views

Is timing attack practical in a web developer's perspective?

Let's say my server has a non-constant-time compare function for checking if the visitor has a valid session id. The time it takes for the comparator to run would be very insignificant, usually within ...
1
vote
1answer
35 views

How does failing to square a value in this version libcrypt++ cause a timing attack vulnerability?

I'm a crypto beginner and reading about blinding, and my fundamental understanding about preventing timing attacks is that you need to sort of process information in a way that will produce similar ...
3
votes
1answer
173 views

GCM mode GHASH sensitivity to timing attacks

In GCM mode of authenticated encryption, is it a security concern if the GHASH implementation timing can vary? If the timing varies according to the AAD/ciphertext data, it looks as though that doesn'...
2
votes
3answers
148 views

Hashing items of different Bytes but same length would enable a timing attack?

I am following this paper which comes highly recommended as a secure Registration/Login system over TLS which uses client side computation for the Password Processing Function (PPF). What my main ...
1
vote
2answers
461 views

Constant time implementations of crypto algorithms

To protect against cache attacks (side channel attacks) generally constant time crypto implementations are advised. In some cases DJB released new algorithms (chacha) that are designed with this in ...
10
votes
1answer
212 views

AES cache-timing attacks and nonce-based operation modes

As I understand it, AES cache-timing attacks exploit the execution time variations due to cache hits/misses, especially the ones depending on the SBox look-up tables which are key-related. To mount ...
2
votes
1answer
128 views

should one worry about timing attacks with signature verification?

To compare two varablies in such a way that timing attacks don't exist it's generally recommended you pad the strings to the same length and then look at each byte, even if an earlier byte was ...
2
votes
3answers
988 views

Does this implementation of a function operate in constant time?

Suppose we have a function that takes $n$ parameters, each being one bit in size, and returns a single bit. Internally, this function has a bit string $N \in \{0, 1\}^{2^n}$ and it operates by using ...
7
votes
1answer
419 views

Does a conditional statement depending on a round number introduce timing attack problems?

In a cryptographic implementation I’m playing with, there’s a round function which includes a conditional if statement. Stripping the superfluous stuff, the C ...
0
votes
1answer
282 views

Cache Timing Attack SHA-3

I’ve been tinkering with SHA-3 for a little bit, and I have some questions regarding the applicability of cache timing attacks on this particular hash function. The two sub functions that I believe ...
6
votes
3answers
697 views

Why don't table lookups run in constant time?

The Wikipedia article on big O notation says that performing a lookup is a constant time operation. So why are lookup tables susceptible to timing attacks?
8
votes
1answer
486 views

What are the implications of a non “constant time” implementations on trusted systems in a non-network scenario?

Assume a scenario where a symmetric encryption algorithm (for example: AES) wasn't implemented in a way it would safeguard against timing attacks. This symmetric encryption implementation is only used ...
6
votes
2answers
528 views

RSA Timing Attack on “Extra” Montgomery Reduction

In "A practical implementation of the timing attack", the authors take advantage of a timing difference that stems from "extra reductions" that occur when multiplying numbers in the Montgomery form. ...
9
votes
2answers
301 views

Timing vulnerability of byte array equality test?

Would the following code to test MAC equality leak timing information ? ...
4
votes
1answer
319 views

Dilithium signature scheme and timing attacks – Does the running time actually depend on the secret key?

The paper “CRYSTALS – Dilithium: Digital Signatures from Module Lattices” (by Léo Ducas, Tancrède Lepoint, Vadim Lyubashevsky, Peter Schwabe, Gregor Seiler, and Damien Stehlé) introduces a digital ...
26
votes
5answers
3k views

Timing-Safety in JVM-Languages

How is it possible to write timing-safe code in JVM-languages (Java, Scala, Clojure...)? Is it possible to make libraries like BouncyCastle safe against timing-attacks? I know that even in C it is ...
3
votes
1answer
102 views

Does the timing of cycle-walking pose a threat?

Cycle-walking is a technique for format-preserving encryption that involves repeating an encryption process until the result is inside a desired range. For example, given an input P, a range R, and ...
1
vote
1answer
439 views

Implementation of a side channel attack? [closed]

As homework I need to find the password of a crackme in ascii-coded binary. We were also given a specific part of the crackme (in the image below), which we will need to use a side channel attack ...
9
votes
2answers
766 views

Are lookup tables safe when they fit in a cache line?

The typical cache line size of modern x86 machines is 64 bytes. Is it safe to use lookup tables with secret data if the table does not exceed the cache line size, and is aligned accordingly? I was ...
3
votes
1answer
124 views

Is having AES tables on a distinct physical page enough to avoid cache timing attacks?

Reading about typical cache timing attacks, they seem to be based on intentional eviction of cache lines and timing how long an operation takes. It seems as if those attacks rely upon these tables ...
49
votes
2answers
9k views

Timing attack and good coding practices

How would timing attack occur on a particular code but not in another code (because of good coding practice)? Could anyone give an example? I am having trouble figuring out how timing attacks would ...
2
votes
1answer
560 views

Is timing analysis attack the same as cache timing attack?

I am working on an essay on timing attacks on DES but then i have seen resources mostly about cache timing attacks. so is timing analysis attack the same as cache timing?
0
votes
1answer
211 views

How long would it take on average to perform a timing attack on HMAC over brute forcing a 32bit tag if the hash is good?

How long would it take on average to perform a timing attack on HMAC over brute forcing a 32bit tag if the hash is good? For example, let's take the hash: 79b7cdc3 to calculate the first byte you ...
2
votes
1answer
2k views

Side Channel Attacks

How to make cipher resist against Side channel Attacks. Specially Timing Attack, Cachet Timing Attach, Simple/ Differential Power Analysis. Uptil now it seems all Standard Algorithms like AES, ...
1
vote
0answers
128 views

Kocher Timing Attack - Error Correction

In class, we learned the Kocher Timing Attacke on modular exponentiation. For determining whether the (e.g., LSB) is 0 or 1, we specified two values: $T_1 = T_M - (TMult(1, y) + (\omega -1)ExpTMult)$ ...
3
votes
1answer
630 views

Is it necessary to worry about timing attacks when comparing SHA256 or Argon2 hashes?

It seems to me that a timing-safe way to compare any two strings is to take a secure hash of both of them and then compare the result. I would expect that the initial hashing would render any timing ...
3
votes
1answer
151 views

Working Precision and Time-constant Arithmetic with ECC?

I am interested in Elliptic Curve Cryptography and found algorithms for constant-time multiplication. Within these algorithms arithmetic operations must be performed (like addition and multiplication)....
5
votes
3answers
125 views

Adding a number congruent to $0$ to ensure that the mod operation takes a constant number of instruction cycles

I've been looking at the s2n implementation of HMAC, and in the `update' function (line 175), it says ...
12
votes
1answer
2k views

Why not use `<`, `>` or `==` in constant time comparison?

I am comparing secret data stored in arrays a and b to see which holds a greater value. My current (pseudo)code looks like this:...
3
votes
0answers
92 views

Attacking Scrypt Under Access Pattern Leakage

Could cache-timing channels (such as exist for certain block ciphers) somehow be made use of in order to extract memory-access pattern information if both the attacker and user are NOT in a shared ...
11
votes
1answer
959 views

Is it possible to test implementation for side-channel attacks?

When it comes to implementing cryptographic algorithms, there seems to be a big focus on the difficulty of doing so without introducing the potential for side channel attacks and the knowledge ...
5
votes
1answer
301 views

Do key-dependent S-boxes make efficient constant-time software implementations almost impossible?

It seems to me that algorithms like Blowfish and Twofish with key-dependent S-boxes are almost impossible to implement without table lookups, and thus are almost impossible to implement in software ...
11
votes
2answers
460 views

Do I need to worry about timing attacks in Base64 encoding/decoding of private keys?

Do I need to worry about timing attacks in Base64 encoding/decoding of private keys? This is a common operation (ex. PEM keys) and is variable time in typical implementations.
1
vote
1answer
158 views

Single-scalar multiplication with sign bit

I want to know if there's an "easy" timing-free way to compute the sign of $y$-coordinate of $r G$, for a secret scalar $r$ and $G$ the generator of an elliptic curve. We have several choices for ...
2
votes
2answers
189 views

is accessing elements of an array in secret order vulnerable to timing attack?

Suppose there is an array containing bytes 0...255. Suppose this array is shuffled using a key for random data. Since this is indexing the elements of a table using secret data, is it vulnerable to ...
3
votes
0answers
215 views

how exploitable are cache timing attacks

So there's a PHP package that's been recently written to protect against cache timing attacks: https://www.reddit.com/r/PHP/comments/4a1iuh/rfc_4648_character_encoding_written_to_resist/ My question ...
4
votes
1answer
55 views

Is it okay to use a variable-time RSA implementation to verify TLS certificates?

RSA as implemented by OpenSSL et al. needs to protect against side channel attacks, at a big performance penalty. However, TLS certificate validation involves no secrets. Therefore, I should be able ...
3
votes
1answer
92 views

Are timing attacks exploitable if each key is used only once?

Suppose that one performs (for example) AES-GCM encryption and decryption using an algorithm that is vulnerable to timing attacks, but each key is used only once. Is it still possible to perform a ...
4
votes
1answer
341 views

ChaCha20 immune to timing attacks

What are the reasons because of which ChaCha20 is immune to timing attacks ? Also why is not AES immune to timing attacks?
0
votes
0answers
37 views

Is it okay to bail out early when length mismatch is detected?

Is it okay to bail out early when length mismatch is detected? Specifically, when verifying authenticated encryption, is it okay to bail out early if the wrong amount of ciphertext or the wrong ...
0
votes
0answers
159 views

Importance of timing attack resistance with AES

I've implemented AES in my library with several variations: a straight C version, a version using x86 SSSE3, and a version using x86 AES-NI. The SSSE3 and AES-NI implementations are constant-time, ...
1
vote
2answers
191 views

Are there any disadvantages of using libsodiums helpers for en-/decoding/comparision instead of the native ones?

Libsodium has some helpers, which allow hexdecimal decoding, encoding and also constant-time string comparison. So if you use the php binding libsodium-php you ...
1
vote
1answer
85 views

Would buffering socket send resist timing attacks

I have been reading and thinking about timing attacks on cryptographic systems. The answer to this question mentions the following: "The way to defend against timing attacks is to make sure the time ...
3
votes
1answer
781 views

RSA: Most significant key bit always 1?

Is it possible to say that the most significant bit of an RSA private exponent is always 1? Wouldn't that weaken the key strength by exactly that one bit? I refer to the paper "Timing Attack: What ...
8
votes
1answer
267 views

Branchless AES Implementation

Imagine a branchless implementation of the AES-128 cipher. Are there any benefits over the implementation that contains branches, other than possible prevention of timing attacks? Is it even true, ...