Highest Voted 'timing-attack' Questions

52

votes

2answers

12k views

Timing attack and good coding practices

How would timing attack occur on a particular code but not in another code (because of good coding practice)? Could anyone give an example? I am having trouble figuring out how timing attacks would ...

timing-attack

asked Nov 21 '16 at 6:52

asdfasd

5211 gold badge5 silver badges3 bronze badges

27

votes

5answers

3k views

Timing-Safety in JVM-Languages

How is it possible to write timing-safe code in JVM-languages (Java, Scala, Clojure...)? Is it possible to make libraries like BouncyCastle safe against timing-attacks? I know that even in C it is ...

asked Jul 5 '17 at 14:11

K. Biermann

5705 silver badges11 bronze badges

21

votes

3answers

5k views

Known methods for constant time (table-free) AES implementation using 'standard' operations?

There are several known methods for implementing AES in constant time using SIMD operations, mostly based around fast byte shuffling (for instance Hamburg and Kasper/Schwabe). Are there any similar ...

implementation aes side-channel-attack timing-attack

asked Jul 12 '11 at 23:03

Jack Lloyd

1,63517 silver badges20 bronze badges

14

votes

1answer

3k views

Why not use `<`, `>` or `==` in constant time comparison?

I am comparing secret data stored in arrays a and b to see which holds a greater value. My current (pseudo)code looks like this:...

side-channel-attack timing-attack

asked Aug 17 '16 at 18:58

Sebastian

3672 silver badges6 bronze badges

13

votes

1answer

2k views

Why do crypto libs use table lookups when they're vulnerable to timing attacks?

AESEngine.java, from BouncyCastle, uses table lookups as does aes_x86core.c, in OpenSSL. But per Cache-timing attacks on AES table lookups like what OpenSSL and BouncyCastle are doing are vulnerable ...

implementation side-channel-attack timing-attack

asked Aug 3 '15 at 15:15

Julie Applegate

1655 bronze badges

13

votes

1answer

2k views

Safely sorting secret data

Suppose you have a secret list of n distinct integers. How would you sort this list in a way that is not vulnerable to timing attacks? I tried looking up "...

side-channel-attack timing-attack

asked Jul 9 '20 at 21:08

Kai Arakawa

1459 bronze badges

12

votes

1answer

1k views

Is it possible to test implementation for side-channel attacks?

When it comes to implementing cryptographic algorithms, there seems to be a big focus on the difficulty of doing so without introducing the potential for side channel attacks and the knowledge ...

implementation side-channel-attack timing-attack

asked Jun 23 '16 at 1:52

DasIch

2231 silver badge6 bronze badges

11

votes

2answers

616 views

Do I need to worry about timing attacks in Base64 encoding/decoding of private keys?

Do I need to worry about timing attacks in Base64 encoding/decoding of private keys? This is a common operation (ex. PEM keys) and is variable time in typical implementations.

keys timing-attack encoding

asked May 23 '16 at 6:15

Demi

4,5111 gold badge14 silver badges34 bronze badges

10

votes

3answers

1k views

Stopping timing attacks on AES: Why is it important to prevent the OS from interrupting the AES computation?

I read the paper Cache-timing attacks on AES (by Daniel J. Bernstein), but I don't seem to understand everything. The author dedicates a long section on how to prevent the OS to interrupt an AES ...

aes timing-attack side-channel-attack

asked Nov 30 '12 at 9:42

cooky451

2472 silver badges7 bronze badges

10

votes

1answer

5k views

AES timing attacks

I'm just interested in cryptography, so please don't expect me to be an expert. ;) I recently read about AES cache timing attacks and found it very interesting. I read the article Cache-timing attacks ...

aes timing-attack side-channel-attack

asked Nov 29 '12 at 17:43

cooky451

2472 silver badges7 bronze badges

10

votes

1answer

330 views

AES cache-timing attacks and nonce-based operation modes

As I understand it, AES cache-timing attacks exploit the execution time variations due to cache hits/misses, especially the ones depending on the SBox look-up tables which are key-related. To mount ...

aes gcm timing-attack ccm

asked Feb 23 '18 at 10:38

Raoul722

2,5572 gold badges13 silver badges33 bronze badges

9

votes

3answers

6k views

Practical Uses for Timing Attacks on Hash Comparisons (e.g. MD5)?

Consider the following code snippet: ...

passwords md5 timing-attack

asked May 12 '15 at 19:10

Scott Arciszewski

66511 silver badges20 bronze badges

9

votes

2answers

881 views

Are lookup tables safe when they fit in a cache line?

The typical cache line size of modern x86 machines is 64 bytes. Is it safe to use lookup tables with secret data if the table does not exceed the cache line size, and is aligned accordingly? I was ...

implementation gcm timing-attack

asked Jan 24 '17 at 0:09

Myria

1,7356 silver badges17 bronze badges

9

votes

1answer

290 views

Are more complex algorithms easier to break with timing attacks?

Is there a point where increasing the complexity of an encryption algorithm will make it easier to break using a timing attack? Or is there no connection here at all?

timing-attack algorithm-design side-channel-attack

asked Jul 27 '11 at 11:39

Shiraz Bhaiji

6051 gold badge5 silver badges8 bronze badges

8

votes

1answer

2k views

How to confirm my implementation is constant time

I'm implementing Schnorr signatures following a variant used in Bitcoin Cash (BCH) of this algorithm: GitHub - Schnorr Signatures for secp256k1. A notable difference is that the BCH schnorr algorithm ...

side-channel-attack timing-attack schnorr-signature

asked May 6 '20 at 3:54

sken

895 bronze badges

8

votes

1answer

521 views

What are the implications of a non “constant time” implementations on trusted systems in a non-network scenario?

Assume a scenario where a symmetric encryption algorithm (for example: AES) wasn't implemented in a way it would safeguard against timing attacks. This symmetric encryption implementation is only used ...

aes cryptanalysis attack timing-attack

asked Oct 18 '17 at 12:20

e-sushi

16.9k12 gold badges69 silver badges205 bronze badges

8

votes

1answer

724 views

Timing attack on RSA as used by CryptoLocker?

So far I have researched timing attacks on RSA, We all know the ransomware named CryptoLocker uses RSA 2048 bit encryption. Now, is it possible to break the encryption using a timing attack. I have ...

rsa timing-attack ransomware

asked Feb 22 '14 at 16:39

user3319959

812 bronze badges

8

votes

2answers

487 views

Timing vulnerability of byte array equality test?

Would the following code to test MAC equality leak timing information ? ...

implementation timing-attack

asked Sep 10 '17 at 10:52

chmike

2391 silver badge6 bronze badges

8

votes

1answer

339 views

Branchless AES Implementation

Imagine a branchless implementation of the AES-128 cipher. Are there any benefits over the implementation that contains branches, other than possible prevention of timing attacks? Is it even true, ...

aes implementation timing-attack

asked Nov 17 '15 at 22:21

Daniel Lovasko

1833 bronze badges

8

votes

1answer

255 views

Do asymmetric signatures require constant-time verification?

To avoid a timing attack, HMAC signatures are usually compared in constant-time (every byte is compared, and the results aggregated). Is the same necessary for asymmetric signature algorithms such ...

public-key signature timing-attack

asked Mar 19 '15 at 21:21

JohnDvorak

4023 silver badges14 bronze badges

7

votes

3answers

1k views

Why don't table lookups run in constant time?

The Wikipedia article on big O notation says that performing a lookup is a constant time operation. So why are lookup tables susceptible to timing attacks?

complexity s-boxes side-channel-attack timing-attack

asked Nov 29 '17 at 17:00

Melab

3,2172 gold badges17 silver badges34 bronze badges

7

votes

3answers

2k views

Timing Attacks on ECDSA, ECDHE, AES and SHA2

Are there any known timing attacks (both practical and theoretical) on any implementations of the following? ECDSA (I'm aware of this one - are there any applicable to prime fields?), ECDHE (again, ...

aes elliptic-curves sha-2 timing-attack

asked Oct 26 '13 at 13:30

Chris Smith

1,1621 gold badge9 silver badges18 bronze badges

7

votes

1answer

441 views

Does a conditional statement depending on a round number introduce timing attack problems?

In a cryptographic implementation I’m playing with, there’s a round function which includes a conditional if statement. Stripping the superfluous stuff, the C ...

algorithm-design implementation timing-attack

asked Dec 16 '17 at 18:00

e-sushi

16.9k12 gold badges69 silver badges205 bronze badges

7

votes

2answers

966 views

RSA Timing Attack on “Extra” Montgomery Reduction

In "A practical implementation of the timing attack", the authors take advantage of a timing difference that stems from "extra reductions" that occur when multiplying numbers in the Montgomery form. ...

rsa side-channel-attack timing-attack montgomery-multiplication

asked Oct 13 '17 at 3:13

kkl

3431 silver badge7 bronze badges

7

votes

1answer

821 views

Can non-assembly crypto libraries truly be secure against timing attacks?

http://cr.yp.to/antiforgery/cachetiming-20050414.pdf states the following: So what went wrong? Answer: NIST failed to recognize that table lookups do not take constant time. “Table lookup: not ...

implementation timing-attack

asked Aug 2 '15 at 3:29

neubert

2,5791 gold badge21 silver badges38 bronze badges

6

votes

2answers

343 views

Should Increment functions be near-constant time?

When operating a block cipher in CTR or GCM mode, should the function used to increment the counter or initialization vector be near-constant time? Here, I'm wondering about the "addition with carry" ...

block-cipher modes-of-operation timing-attack

asked Nov 3 '15 at 0:52

user10496

6

votes

1answer

465 views

Double-and-add/Montgomery VS blinding

I'm having a hard time understanding why people use constant-time techniques to counter time-attacks, when blinding seems as good and cheaper to implement. Why do people avoid blinding in ECC?

elliptic-curves side-channel-attack timing-attack blinding

asked Apr 22 '15 at 15:29

David 天宇 Wong

1,33510 silver badges21 bronze badges

6

votes

2answers

367 views

Attack vectors introduced by compilers

I have a question about attacks on the implementation of cryptographic code that are enabled by compilation and compiler-optimisations. I am aware of this. Would anyone be able to point me to other ...

timing-attack

asked Jun 6 '12 at 16:10

Martin Berger

2152 silver badges10 bronze badges

6

votes

1answer

110 views

Adapting RSA Timing Attack for Square And Multiply from right-to-left vs left-to-right

I'm trying to reconstruct the fairly well-known RSA timing attack by Kocher. I'm working with simulated timing data, so I have completely noise-free "measurements". My attack is successful ...

rsa timing-attack

asked Aug 23 '20 at 23:31

Richard

712 bronze badges

5

votes

3answers

129 views

Adding a number congruent to $0$ to ensure that the mod operation takes a constant number of instruction cycles

I've been looking at the s2n implementation of HMAC, and in the `update' function (line 175), it says ...

hmac implementation modular-arithmetic timing-attack

asked Aug 30 '16 at 10:42

man_in_green_shirt

1654 bronze badges

5

votes

1answer

1k views

Is it necessary to worry about timing attacks when comparing SHA256 or Argon2 hashes?

It seems to me that a timing-safe way to compare any two strings is to take a secure hash of both of them and then compare the result. I would expect that the initial hashing would render any timing ...

sha-256 timing-attack argon2

asked Oct 4 '16 at 2:17

Demi

4,5111 gold badge14 silver badges34 bronze badges

5

votes

1answer

321 views

Do key-dependent S-boxes make efficient constant-time software implementations almost impossible?

It seems to me that algorithms like Blowfish and Twofish with key-dependent S-boxes are almost impossible to implement without table lookups, and thus are almost impossible to implement in software ...

s-boxes timing-attack

asked May 24 '16 at 2:22

Demi

4,5111 gold badge14 silver badges34 bronze badges

5

votes

2answers

824 views

Timing attacks against RSA, DH and AES

I have been reading about “Timing Attacks on RSA: Revealing Your Secrets through the Fourth Dimension” by Wing H. Wong. I was wondering if this attack is feasible while signing with RSA and, if yes, ...

rsa aes timing-attack

asked Mar 11 '14 at 17:19

Tim

511 bronze badge

5

votes

1answer

304 views

How exploitable are cache timing attacks?

So there's a recent PHP package that has been written to protect against cache timing attacks, which can be seen here . My question is... just how exploitable are cache timing attacks? My overall ...

timing-attack

asked Mar 12 '16 at 15:09

neubert

2,5791 gold badge21 silver badges38 bronze badges

4

votes

2answers

1k views

Constant time implementations of crypto algorithms

To protect against cache attacks (side channel attacks) generally constant time crypto implementations are advised. In some cases DJB released new algorithms (chacha) that are designed with this in ...

side-channel-attack cryptographic-hardware timing-attack

asked Mar 12 '18 at 1:56

stflow

634 bronze badges

4

votes

1answer

436 views

ChaCha20 immune to timing attacks

What are the reasons because of which ChaCha20 is immune to timing attacks ? Also why is not AES immune to timing attacks?

aes side-channel-attack timing-attack chacha

asked Feb 23 '16 at 17:48

Shridhar R Kulkarni

4076 silver badges11 bronze badges

4

votes

1answer

458 views

Constant Time Multiplication for Cryptography in Pure Software without Hardware Multiplier or Barrel Shifter

To prevent various forms of timing side-channel attacks, it's strongly advisable to implementing public-key cryptography in constant time. Or at least, without secret-dependent timing variations. ...

timing-attack

asked Feb 8 at 5:24

比尔盖子

815 bronze badges

4

votes

1answer

199 views

Synthetic Jitter to Combat Timing Attacks

We are working on some tooling. It has a networking kernel. We would like to think that jitter built into the kernel would help with timing attacks? Is this true?

randomness timing-attack

asked Aug 12 '18 at 17:44

cryptoJim

512 bronze badges

4

votes

1answer

830 views

Double randomised HMAC verification to prevent timing attack

A way to prevent timing attacks for hash string comparison is to perform additional HMAC signing in order to randomize the verification process (see Double HMAC Verification). In addition to the ...

encryption hash hmac timing-attack

asked Oct 25 '15 at 20:23

azren

6711 gold badge5 silver badges6 bronze badges

4

votes

1answer

377 views

Dilithium signature scheme and timing attacks – Does the running time actually depend on the secret key?

The paper “CRYSTALS – Dilithium: Digital Signatures from Module Lattices” (by Léo Ducas, Tancrède Lepoint, Vadim Lyubashevsky, Peter Schwabe, Gregor Seiler, and Damien Stehlé) introduces a digital ...

post-quantum-cryptography lattice-crypto side-channel-attack timing-attack

asked Jul 30 '17 at 4:26

Demi

4,5111 gold badge14 silver badges34 bronze badges

4

votes

1answer

62 views

Is it okay to use a variable-time RSA implementation to verify TLS certificates?

RSA as implemented by OpenSSL et al. needs to protect against side channel attacks, at a big performance penalty. However, TLS certificate validation involves no secrets. Therefore, I should be able ...

rsa tls side-channel-attack timing-attack

asked Mar 11 '16 at 5:42

Demi

4,5111 gold badge14 silver badges34 bronze badges

4

votes

1answer

372 views

Performing HMAC with random key before MAC comparison

In Laravel (a PHP framework) I can see that they calculate a HMAC with a random key over the final HMAC before comparison. This additional HMAC calculation is of course performed for both the ...

authentication mac hmac timing-attack

asked Jan 17 '15 at 15:27

Maarten Bodewes♦

77.8k11 gold badges123 silver badges266 bronze badges

3

votes

1answer

276 views

GCM mode GHASH sensitivity to timing attacks

In GCM mode of authenticated encryption, is it a security concern if the GHASH implementation timing can vary? If the timing varies according to the AAD/ciphertext data, it looks as though that doesn'...

gcm timing-attack

asked May 29 '18 at 2:28

Craig McQueen

2522 silver badges8 bronze badges

3

votes

1answer

2k views

Side Channel Attacks

How to make cipher resist against Side channel Attacks. Specially Timing Attack, Cachet Timing Attach, Simple/ Differential Power Analysis. Uptil now it seems all Standard Algorithms like AES, ...

aes side-channel-attack timing-attack camellia

asked Nov 11 '16 at 6:32

crypt

1,85211 silver badges23 bronze badges

3

votes

1answer

92 views

Are timing attacks exploitable if each key is used only once?

Suppose that one performs (for example) AES-GCM encryption and decryption using an algorithm that is vulnerable to timing attacks, but each key is used only once. Is it still possible to perform a ...

timing-attack

asked Feb 24 '16 at 23:26

Demi

4,5111 gold badge14 silver badges34 bronze badges

3

votes

1answer

152 views

Potential vulnerability in DH key selection - am I understanding this right?

I'm reading through a DH implementation, and I think I found a potential hole. Public $p$ and $g$ values are properly selected. A candidate secret value $\bar a$ is pseudo-randomly selected such that ...

random-number-generator diffie-hellman timing-attack

asked Mar 27 '13 at 11:15

Polynomial

3,1733 gold badges23 silver badges41 bronze badges

3

votes

1answer

148 views

Is having AES tables on a distinct physical page enough to avoid cache timing attacks?

Reading about typical cache timing attacks, they seem to be based on intentional eviction of cache lines and timing how long an operation takes. It seems as if those attacks rely upon these tables ...

aes side-channel-attack timing-attack

asked Jan 5 '17 at 23:46

Myria

1,7356 silver badges17 bronze badges

3

votes

1answer

113 views

Does the timing of cycle-walking pose a threat?

Cycle-walking is a technique for format-preserving encryption that involves repeating an encryption process until the result is inside a desired range. For example, given an input P, a range R, and ...

cryptanalysis timing-attack format-preserving

asked Jul 2 '17 at 1:02

Daffy

2,25713 silver badges26 bronze badges

3

votes

1answer

202 views

Working Precision and Time-constant Arithmetic with ECC?

I am interested in Elliptic Curve Cryptography and found algorithms for constant-time multiplication. Within these algorithms arithmetic operations must be performed (like addition and multiplication)....

elliptic-curves timing-attack

asked Aug 30 '16 at 20:31

user3637203

1533 bronze badges

3

votes

1answer

1k views

RSA: Most significant key bit always 1?

Is it possible to say that the most significant bit of an RSA private exponent is always 1? Wouldn't that weaken the key strength by exactly that one bit? I refer to the paper "Timing Attack: What ...

rsa keys timing-attack

asked Nov 28 '15 at 20:40

pafodie

314 bronze badges

Questions tagged [timing-attack]

Related Tags