# Questions tagged [timing-attack]

The side channel attack is based on the fact that the time difference between certain operations executed by the implementation of a cryptographic scheme allow an adversary to get information that he didn't have according to the theoretical specification of the scheme.

112 questions
Filter by
Sorted by
Tagged with
42 views

### How to find openSSL's AES T-table location for cache side channel attack

Let us assume I have a physically-indexed last-level cache, which is shared between the victim and adversary. Both the victim and attacker have their own copy of openSSL library in the caches. Victim ...
119 views

### Has garbage-collection been used for side-channel attacks?

I'm thinking of cryptographic implementations on garbage-collected (gc) languages/runtimes and that the gc process can be potentially dangerous for an implementation even if the implementation has the ...
1 vote
130 views

### Is an if-else calling same function(s) vulnerable to side channel attacks

If I have a function f(x, y) and g(x, y) and f and g a are constant time, is the following code vulnerable to side channel ...
73 views

### Does a secret-dependent order of access of a lookup table create a possibility for a timing attack?

There are attacks that can extract some information from lookup table access that depends on a secret value, e.g. if we access a[0] or ...
2k views

### Multiplication implemented in c++ with constant time

I'm considering some non-cryptographic PRNG which uses multiplication of two 64-bit or 128-bit random numbers at some point. ...
1 vote
92 views

### Constant-time decompression on an elliptic curve

Let $E\!: y^2 = f(x)$ be an elliptic curve over a finite field $\mathbb{F}_{q}$ of odd characteristic. Consider an $\mathbb{F}_{q}$-point $P = (x,y)$ on $E$. Suppose that we only have the $x$-...
6k views

### How can I understand whether my C implementation is constant-time or not (i.e. resistant to timing attacks)

I have a code for polynomial multiplication and it is written in C. I heard that whether a particular instruction is "constant time" can vary by architecture and by processor model and there ...
1 vote
95 views

### Are you aware of cryptographic contexts (e.g., post-quantum) in which a square root $\sqrt{\cdot}$ must be computed in constant time?

Let $\mathbb{F}_q$ be a finite field of odd characteristic. I know that a constant-time implementation of the square root extraction $\sqrt{\cdot} \in \mathbb{F}_q$ is used in the context of hashing ...
694 views

### Resistance against timing attacks of AES candidates

It's difficult to implement AES securely and efficiently if the adversary can observe the timing and (approximate) location of memory accesses, unless you have dedicated hardware. The naive ...
580 views

### Dilithium signature scheme and timing attacks – Does the running time actually depend on the secret key?

The paper “CRYSTALS – Dilithium: Digital Signatures from Module Lattices” (by Léo Ducas, Tancrède Lepoint, Vadim Lyubashevsky, Peter Schwabe, Gregor Seiler, and Damien Stehlé) introduces a digital ...
1 vote
86 views

### How new cache designs stop cache-based side channel attacks

How do new cache designs aid in defending against cache-based side-channel attacks? While conducting a side-channel attack, we have the T-table/S-virtual box's address. Normally, address mapping is ...
168 views

### Attacking Scrypt Under Access Pattern Leakage

Could cache-timing channels (such as exist for certain block ciphers) somehow be made use of in order to extract memory-access pattern information if both the attacker and user are NOT in a shared ...
711 views

### Is constant-time compare really required for AEAD ciphers?

When verifying a (HMAC) authentication tag it is often indicated that a constant-time comparison is required for security. I can see how leaking information about a password hash can introduce a mild ...
95 views

### Constant time empty string validation

Checks for null require an == check. If you have a string secret (say a hex-encoded key) and you want to check it's empty for validation should you compare it to <...
1k views

### Constant time comparison for arrays of different lengths

I found the following code snippet from the Bouncy Castle C# library, which seems to claim that it's constant time, even when the arrays have different lengths. ...
1k views

### Is If/else vulnerable to timing side-channel attacks?

I have a branching in c++: if (x & 1) { x = function_1(x); } else { x = function_2(x); } If function_1 and ...
2k views

### Defence against timing attacks

I know this is a difficult subject but would a good defense against timing attacks be not sending a message if the decryption or authentication fails? So if the attacker provides a wrong HMAC for ...
143 views

### AES XEX Mode: Cache-attacks demonstrated?

Assume AES in XEX mode, so we encrypt a plaintext $x$ as $E_K[x \oplus k_1] \oplus k_2$ where $E_K$ is the usual AES Block cipher (assume $x$ is of block size). Assume the implementation of AES is ...
1 vote
268 views

### Timing attacks: Symmetric vs Asymmetric Algorithms

There is a statement that I can't give a reference; "Since the timing characteristics of symmetric algorithms are not as key dependent as asymmetric algorithms, they are more resistant against ...
1 vote
175 views

### How is the Argon2d side channel attack performed?

How should the adversary behave in order to perform a successful side channel attack against Argon2d? I'm trying to understand the scenario that Argon2i tries to resist against.
235 views

### Chinese remainder theorem in ECDSA for parameters in secp256k1?

It is known that it is possible to apply the Chinese remainder theorem and attack RSA under precise conditions. https://tls.mbed.org/public/WSchindler-...
851 views

### Do I need to worry about timing attacks in Base64 encoding/decoding of private keys?

Do I need to worry about timing attacks in Base64 encoding/decoding of private keys? This is a common operation (ex. PEM keys) and is variable time in typical implementations.
155 views

### How to ensure that a cryptographic implementation is reasonably sound/robust?

I know from the bottom of my heart how bad the idea of custom-crypto is. I absolutely concur with the recommendation that it should only be done by professionals who specialize in implementing crypto ...
1 vote
190 views

### Why is implementation relevant to timing attacks?

Discussions from highly respected sources (details below) emphasize the importance of the implementation of cryptographic software to the effective security provided, with one particular case being ...
1 vote
188 views

### How feasible is it to guess the private key of libsodium by taking into account generation time?

So suppose you are doing this locally (so no network noise), and know the exact specifics of your processor too. Is it feasible to figure out the private key (while having access to the public-key) ...
762 views

### Timing attack on RSA as used by CryptoLocker?

So far I have researched timing attacks on RSA, We all know the ransomware named CryptoLocker uses RSA 2048 bit encryption. Now, is it possible to break the encryption using a timing attack. I have ...
604 views

### Constant Time Multiplication for Cryptography in Pure Software without Hardware Multiplier or Barrel Shifter

To prevent various forms of timing side-channel attacks, it's strongly advisable to implementing public-key cryptography in constant time. Or at least, without secret-dependent timing variations. ...
110 views

### Is is safe to use MtEtM? (MAC-then-Encrypt and Encrypt-than-MAC)

Assuming I am using different secrets/keys for each MAC pass, does running both MtE and EtM creates any vulnerability? This is what I mean about doing MtEtM: ...
548 views

### Adapting RSA Timing Attack for Square And Multiply from right-to-left vs left-to-right

I'm trying to reconstruct the fairly well-known RSA timing attack by Kocher. I'm working with simulated timing data, so I have completely noise-free "measurements". My attack is successful ...
2k views

### Safely sorting secret data

Suppose you have a secret list of n distinct integers. How would you sort this list in a way that is not vulnerable to timing attacks? I tried looking up "...
710 views

### Is AES without T-Tables nor S-Box resistant to side-channel?

T-Tables and S-Boxes are prone to side-channel attacks, is an implementation without any lookup tables resistant to side-channel ? In this answer, https://crypto.stackexchange.com/a/63520/80926, the ...
402 views

### Attack vectors introduced by compilers

I have a question about attacks on the implementation of cryptographic code that are enabled by compilation and compiler-optimisations. I am aware of this. Would anyone be able to point me to other ...
2k views

### How to confirm my implementation is constant time

I'm implementing Schnorr signatures following a variant used in Bitcoin Cash (BCH) of this algorithm: GitHub - Schnorr Signatures for secp256k1. A notable difference is that the BCH schnorr algorithm ...
180 views

### Can someone explain the timing attack on RSA with Montgomery multiplication?

I have read several articles on the temporal attack against Montgomery multiplication to speedup RSA computations. However, I do not quite get the principle. I understood that there is a additional ...
700 views

### Mitigating timing attacks with a random sleep

Could you mitigate all timing attacks by putting a sleep(random()) with a naive crypto implementation? Eg if your implementation looks solid, but you're not sure what the next CPU cache vulnerability ...
748 views

### How to make an AES implementation using lookup tables immune to cache timing attacks?

I recently made a very naive implementation of AES using lookup tables, but it's totally unsafe because of timing attacks. I am not interested in using the processor specific instructions for AES, ...
1 vote
514 views

### Question about RSA timing attack and a Chosen Ciphertext Attack on RSA

I am quite new to the RSA and I have a couple of questions that confuse me. Q1: A Timing attack on RSA can be prevented _____________________________ A. By performing the “square and multiply” ...
61 views

### exfiltrating salts with timing attacks?

It seems to me that it's theoretically possible to exfiltrate a salt against a hashing algorithm that isn't constant time using specially crafted inputs. Are there any examples of this being done in ...
346 views

### How exploitable are cache timing attacks?

So there's a recent PHP package that has been written to protect against cache timing attacks, which can be seen here . My question is... just how exploitable are cache timing attacks? My overall ...
2k views

### RSA Timing Attack on "Extra" Montgomery Reduction

In "A practical implementation of the timing attack", the authors take advantage of a timing difference that stems from "extra reductions" that occur when multiplying numbers in the Montgomery form. ...
267 views

### Synthetic Jitter to Combat Timing Attacks

We are working on some tooling. It has a networking kernel. We would like to think that jitter built into the kernel would help with timing attacks? Is this true?
1 vote
159 views

### Side channel attack: Why building an eviction set is possible?

I'm learning about the side channel attack on the cache. I came to know that most of the attack (EVICT + TIME, PRIME + PROBE, PRIME + ABORT) on the cache is initiated by building an eviction set(a ...
2k views

### Is it necessary to worry about timing attacks when comparing SHA256 or Argon2 hashes?

It seems to me that a timing-safe way to compare any two strings is to take a secure hash of both of them and then compare the result. I would expect that the initial hashing would render any timing ...
79 views

### One time code appended to password

Apologies in advance, I'm a beginner and my knowledge of terminology in this field probably reflects that. I have a question about one-time codes being used with passwords. What inspires me to ask ...
75 views

### RSA: Blinding versus fixed-time computation

For RSA, what is the standard solution against timing attacks? I know about RSA blinding as one solution. Another solution is to always compute both the squared value and square-and-multiply values, ...
293 views

### Hashing items of different Bytes but same length would enable a timing attack?

I am following this paper which comes highly recommended as a secure Registration/Login system over TLS which uses client side computation for the Password Processing Function (PPF). What my main ...
1k views

### The attacker model of the Lucky13 attack in TLS

Lucky13 is a timing attack against the MAC in the CBC MAC-then-encrypt ciphersuites. In the attack's page: The attacks involve detecting small differences in the time at which TLS error messages ...
3k views

### Why don't table lookups run in constant time?

The Wikipedia article on big O notation says that performing a lookup is a constant time operation. So why are lookup tables susceptible to timing attacks?
1 vote