Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [timing-attack]

side channel attack based on the different speed at which certain operations are executed.

48
votes
2answers
9k views

Timing attack and good coding practices

How would timing attack occur on a particular code but not in another code (because of good coding practice)? Could anyone give an example? I am having trouble figuring out how timing attacks would ...
26
votes
5answers
3k views

Timing-Safety in JVM-Languages

How is it possible to write timing-safe code in JVM-languages (Java, Scala, Clojure...)? Is it possible to make libraries like BouncyCastle safe against timing-attacks? I know that even in C it is ...
21
votes
3answers
4k views

Known methods for constant time (table-free) AES implementation using 'standard' operations?

There are several known methods for implementing AES in constant time using SIMD operations, mostly based around fast byte shuffling (for instance Hamburg and Kasper/Schwabe). Are there any similar ...
12
votes
1answer
2k views

Why not use `<`, `>` or `==` in constant time comparison?

I am comparing secret data stored in arrays a and b to see which holds a greater value. My current (pseudo)code looks like this:...
12
votes
1answer
2k views

Why do crypto libs use table lookups when they're vulnerable to timing attacks?

AESEngine.java, from BouncyCastle, uses table lookups as does aes_x86core.c, in OpenSSL. But per Cache-timing attacks on AES table lookups like what OpenSSL and BouncyCastle are doing are vulnerable ...
11
votes
1answer
936 views

Is it possible to test implementation for side-channel attacks?

When it comes to implementing cryptographic algorithms, there seems to be a big focus on the difficulty of doing so without introducing the potential for side channel attacks and the knowledge ...
11
votes
2answers
447 views

Do I need to worry about timing attacks in Base64 encoding/decoding of private keys?

Do I need to worry about timing attacks in Base64 encoding/decoding of private keys? This is a common operation (ex. PEM keys) and is variable time in typical implementations.
10
votes
3answers
1k views

Stopping timing attacks on AES: Why is it important to prevent the OS from interrupting the AES computation?

I read the paper Cache-timing attacks on AES (by Daniel J. Bernstein), but I don't seem to understand everything. The author dedicates a long section on how to prevent the OS to interrupt an AES ...
10
votes
1answer
4k views

AES timing attacks

I'm just interested in cryptography, so please don't expect me to be an expert. ;) I recently read about AES cache timing attacks and found it very interesting. I read the article Cache-timing attacks ...
10
votes
1answer
201 views

AES cache-timing attacks and nonce-based operation modes

As I understand it, AES cache-timing attacks exploit the execution time variations due to cache hits/misses, especially the ones depending on the SBox look-up tables which are key-related. To mount ...
9
votes
2answers
753 views

Are lookup tables safe when they fit in a cache line?

The typical cache line size of modern x86 machines is 64 bytes. Is it safe to use lookup tables with secret data if the table does not exceed the cache line size, and is aligned accordingly? I was ...
9
votes
2answers
281 views

Timing vulnerability of byte array equality test?

Would the following code to test MAC equality leak timing information ? ...
8
votes
3answers
4k views

Practical Uses for Timing Attacks on Hash Comparisons (e.g. MD5)?

Consider the following code snippet: ...
8
votes
1answer
279 views

Are more complex algorithms easier to break with timing attacks?

Is there a point where increasing the complexity of an encryption algorithm will make it easier to break using a timing attack? Or is there no connection here at all?
8
votes
1answer
477 views

What are the implications of a non “constant time” implementations on trusted systems in a non-network scenario?

Assume a scenario where a symmetric encryption algorithm (for example: AES) wasn't implemented in a way it would safeguard against timing attacks. This symmetric encryption implementation is only used ...
8
votes
1answer
263 views

Branchless AES Implementation

Imagine a branchless implementation of the AES-128 cipher. Are there any benefits over the implementation that contains branches, other than possible prevention of timing attacks? Is it even true, ...
8
votes
1answer
182 views

Do asymmetric signatures require constant-time verification?

To avoid a timing attack, HMAC signatures are usually compared in constant-time (every byte is compared, and the results aggregated). Is the same necessary for asymmetric signature algorithms such ...
8
votes
1answer
781 views

Can non-assembly crypto libraries truly be secure against timing attacks?

http://cr.yp.to/antiforgery/cachetiming-20050414.pdf states the following: So what went wrong? Answer: NIST failed to recognize that table lookups do not take constant time. “Table lookup: not ...
7
votes
1answer
417 views

Does a conditional statement depending on a round number introduce timing attack problems?

In a cryptographic implementation I’m playing with, there’s a round function which includes a conditional if statement. Stripping the superfluous stuff, the C ...
7
votes
1answer
683 views

Timing attack on RSA as used by CryptoLocker?

So far I have researched timing attacks on RSA, We all know the ransomware named CryptoLocker uses RSA 2048 bit encryption. Now, is it possible to break the encryption using a timing attack. I have ...
6
votes
3answers
635 views

Why don't table lookups run in constant time?

The Wikipedia article on big O notation says that performing a lookup is a constant time operation. So why are lookup tables susceptible to timing attacks?
6
votes
2answers
465 views

RSA Timing Attack on “Extra” Montgomery Reduction

In "A practical implementation of the timing attack", the authors take advantage of a timing difference that stems from "extra reductions" that occur when multiplying numbers in the Montgomery form. ...
6
votes
2answers
296 views

Should Increment functions be near-constant time?

When operating a block cipher in CTR or GCM mode, should the function used to increment the counter or initialization vector be near-constant time? Here, I'm wondering about the "addition with carry" ...
6
votes
1answer
347 views

Attack vectors introduced by compilers

I have a question about attacks on the implementation of cryptographic code that are enabled by compilation and compiler-optimisations. I am aware of this. Would anyone be able to point me to other ...
5
votes
3answers
2k views

Timing Attacks on ECDSA, ECDHE, AES and SHA2

Are there any known timing attacks (both practical and theoretical) on any implementations of the following? ECDSA (I'm aware of this one - are there any applicable to prime fields?), ECDHE (again, ...
5
votes
3answers
123 views

Adding a number congruent to $0$ to ensure that the mod operation takes a constant number of instruction cycles

I've been looking at the s2n implementation of HMAC, and in the `update' function (line 175), it says ...
5
votes
1answer
299 views

Do key-dependent S-boxes make efficient constant-time software implementations almost impossible?

It seems to me that algorithms like Blowfish and Twofish with key-dependent S-boxes are almost impossible to implement without table lookups, and thus are almost impossible to implement in software ...
5
votes
2answers
480 views

Timing attacks against RSA, DH and AES

I have been reading about “Timing Attacks on RSA: Revealing Your Secrets through the Fourth Dimension” by Wing H. Wong. I was wondering if this attack is feasible while signing with RSA and, if yes, ...
4
votes
1answer
329 views

ChaCha20 immune to timing attacks

What are the reasons because of which ChaCha20 is immune to timing attacks ? Also why is not AES immune to timing attacks?
4
votes
1answer
570 views

Double randomised HMAC verification to prevent timing attack

A way to prevent timing attacks for hash string comparison is to perform additional HMAC signing in order to randomize the verification process (see Double HMAC Verification). In addition to the ...
4
votes
1answer
589 views

Is it necessary to worry about timing attacks when comparing SHA256 or Argon2 hashes?

It seems to me that a timing-safe way to compare any two strings is to take a secure hash of both of them and then compare the result. I would expect that the initial hashing would render any timing ...
4
votes
1answer
318 views

Double-and-add/Montgomery VS blinding

I'm having a hard time understanding why people use constant-time techniques to counter time-attacks, when blinding seems as good and cheaper to implement. Why do people avoid blinding in ECC?
4
votes
1answer
122 views

Is having AES tables on a distinct physical page enough to avoid cache timing attacks?

Reading about typical cache timing attacks, they seem to be based on intentional eviction of cache lines and timing how long an operation takes. It seems as if those attacks rely upon these tables ...
4
votes
1answer
302 views

Dilithium signature scheme and timing attacks – Does the running time actually depend on the secret key?

The paper “CRYSTALS – Dilithium: Digital Signatures from Module Lattices” (by Léo Ducas, Tancrède Lepoint, Vadim Lyubashevsky, Peter Schwabe, Gregor Seiler, and Damien Stehlé) introduces a digital ...
4
votes
1answer
55 views

Is it okay to use a variable-time RSA implementation to verify TLS certificates?

RSA as implemented by OpenSSL et al. needs to protect against side channel attacks, at a big performance penalty. However, TLS certificate validation involves no secrets. Therefore, I should be able ...
3
votes
1answer
159 views

GCM mode GHASH sensitivity to timing attacks

In GCM mode of authenticated encryption, is it a security concern if the GHASH implementation timing can vary? If the timing varies according to the AAD/ciphertext data, it looks as though that doesn'...
3
votes
1answer
92 views

Are timing attacks exploitable if each key is used only once?

Suppose that one performs (for example) AES-GCM encryption and decryption using an algorithm that is vulnerable to timing attacks, but each key is used only once. Is it still possible to perform a ...
3
votes
1answer
151 views

Potential vulnerability in DH key selection - am I understanding this right?

I'm reading through a DH implementation, and I think I found a potential hole. Public $p$ and $g$ values are properly selected. A candidate secret value $\bar a$ is pseudo-randomly selected such that ...
3
votes
1answer
114 views

should one worry about timing attacks with signature verification?

To compare two varablies in such a way that timing attacks don't exist it's generally recommended you pad the strings to the same length and then look at each byte, even if an earlier byte was ...
3
votes
1answer
95 views

Does the timing of cycle-walking pose a threat?

Cycle-walking is a technique for format-preserving encryption that involves repeating an encryption process until the result is inside a desired range. For example, given an input P, a range R, and ...
3
votes
1answer
147 views

Working Precision and Time-constant Arithmetic with ECC?

I am interested in Elliptic Curve Cryptography and found algorithms for constant-time multiplication. Within these algorithms arithmetic operations must be performed (like addition and multiplication)....
3
votes
2answers
188 views

is accessing elements of an array in secret order vulnerable to timing attack?

Suppose there is an array containing bytes 0...255. Suppose this array is shuffled using a key for random data. Since this is indexing the elements of a table using secret data, is it vulnerable to ...
3
votes
1answer
765 views

RSA: Most significant key bit always 1?

Is it possible to say that the most significant bit of an RSA private exponent is always 1? Wouldn't that weaken the key strength by exactly that one bit? I refer to the paper "Timing Attack: What ...
3
votes
1answer
104 views

Can string lookups be vulnerable to timing attacks like array lookups are?

Per “Can non-assembly crypto libraries truly be secure against timing attacks?”, array lookups are vulnerable to timing attacks. Like, if you do cresult[map[i]] and ...
3
votes
1answer
263 views

Performing HMAC with random key before MAC comparison

In Laravel (a PHP framework) I can see that they calculate a HMAC with a random key over the final HMAC before comparison. This additional HMAC calculation is of course performed for both the ...
3
votes
0answers
92 views

Attacking Scrypt Under Access Pattern Leakage

Could cache-timing channels (such as exist for certain block ciphers) somehow be made use of in order to extract memory-access pattern information if both the attacker and user are NOT in a shared ...
3
votes
0answers
213 views

how exploitable are cache timing attacks

So there's a PHP package that's been recently written to protect against cache timing attacks: https://www.reddit.com/r/PHP/comments/4a1iuh/rfc_4648_character_encoding_written_to_resist/ My question ...
3
votes
0answers
197 views

Timing Attack on OpenSSL by Brumley

I am referring to this paper by David Brumley and Dan Boneh: Remote Timing Attacks are Practical (In proceedings of the 12th Usenix Security Symposium, 2003). In this paper on page 4, Brumley ...
2
votes
3answers
962 views

Does this implementation of a function operate in constant time?

Suppose we have a function that takes $n$ parameters, each being one bit in size, and returns a single bit. Internally, this function has a bit string $N \in \{0, 1\}^{2^n}$ and it operates by using ...
2
votes
1answer
498 views

Is timing analysis attack the same as cache timing attack?

I am working on an essay on timing attacks on DES but then i have seen resources mostly about cache timing attacks. so is timing analysis attack the same as cache timing?