Newest 'timing-attack' Questions

1

vote

0answers

36 views

Side channel attack: Why building an eviction set is possible?

I'm learning about the side channel attack on the cache. I came to know that most of the attack (EVICT + TIME, PRIME + PROBE, PRIME + ABORT) on the cache is initiated by building an eviction set(a ...

asked Jun 13 at 2:15

Shariful Alam

111 bronze badge

0

votes

0answers

32 views

One time code appended to password

Apologies in advance, I'm a beginner and my knowledge of terminology in this field probably reflects that. I have a question about one-time codes being used with passwords. What inspires me to ask ...

timing-attack one-time-password

asked Mar 29 at 18:31

MadisonCooper

1

2

votes

0answers

36 views

RSA: Blinding versus fixed-time computation

For RSA, what is the standard solution against timing attacks? I know about RSA blinding as one solution. Another solution is to always compute both the squared value and square-and-multiply values, ...

rsa side-channel-attack timing-attack

asked Mar 20 at 22:02

Myria

1,0455 silver badges14 bronze badges

2

votes

2answers

769 views

The attacker model of the Lucky13 attack in TLS

Lucky13 is a timing attack against the MAC in the CBC MAC-then-encrypt ciphersuites. In the attack's page: The attacks involve detecting small differences in the time at which TLS error messages ...

tls cbc openssl cbc-mac timing-attack

asked Oct 27 '18 at 21:22

user9371654

1901 silver badge8 bronze badges

1

vote

1answer

73 views

obscuring timing attacks in vulnerable libraries

Let's say you're using a library that you know is vulnerable to timing attacks. Short of switching libraries all together it seems to me that putting a sleep in the ...

timing-attack

asked Sep 26 '18 at 19:37

neubert

1,47215 silver badges31 bronze badges

3

votes

1answer

153 views

Synthetic Jitter to Combat Timing Attacks

We are working on some tooling. It has a networking kernel. We would like to think that jitter built into the kernel would help with timing attacks? Is this true?

randomness timing-attack

asked Aug 12 '18 at 17:44

cryptoJim

212 bronze badges

2

votes

0answers

59 views

Is timing attack practical in a web developer's perspective?

Let's say my server has a non-constant-time compare function for checking if the visitor has a valid session id. The time it takes for the comparator to run would be very insignificant, usually within ...

authentication timing-attack

asked Aug 11 '18 at 10:03

longcc

111 bronze badge

1

vote

1answer

36 views

How does failing to square a value in this version libcrypt++ cause a timing attack vulnerability?

I'm a crypto beginner and reading about blinding, and my fundamental understanding about preventing timing attacks is that you need to sort of process information in a way that will produce similar ...

timing-attack

asked Jul 30 '18 at 13:30

john doe

1083 bronze badges

3

votes

1answer

195 views

GCM mode GHASH sensitivity to timing attacks

In GCM mode of authenticated encryption, is it a security concern if the GHASH implementation timing can vary? If the timing varies according to the AAD/ciphertext data, it looks as though that doesn'...

gcm timing-attack

asked May 29 '18 at 2:28

Craig McQueen

2172 silver badges8 bronze badges

2

votes

3answers

149 views

Hashing items of different Bytes but same length would enable a timing attack?

I am following this paper which comes highly recommended as a secure Registration/Login system over TLS which uses client side computation for the Password Processing Function (PPF). What my main ...

hash password-hashing timing-attack

asked Mar 26 '18 at 2:57

Lolu Gewub

112 bronze badges

1

vote

2answers

536 views

Constant time implementations of crypto algorithms

To protect against cache attacks (side channel attacks) generally constant time crypto implementations are advised. In some cases DJB released new algorithms (chacha) that are designed with this in ...

side-channel-attack cryptographic-hardware timing-attack

asked Mar 12 '18 at 1:56

stflow

183 bronze badges

10

votes

1answer

226 views

AES cache-timing attacks and nonce-based operation modes

As I understand it, AES cache-timing attacks exploit the execution time variations due to cache hits/misses, especially the ones depending on the SBox look-up tables which are key-related. To mount ...

aes gcm timing-attack ccm

asked Feb 23 '18 at 10:38

Raoul722

1,9922 gold badges11 silver badges27 bronze badges

2

votes

1answer

142 views

should one worry about timing attacks with signature verification?

To compare two varablies in such a way that timing attacks don't exist it's generally recommended you pad the strings to the same length and then look at each byte, even if an earlier byte was ...

public-key signature dsa timing-attack

asked Feb 10 '18 at 22:09

neubert

1,47215 silver badges31 bronze badges

2

votes

3answers

1k views

Does this implementation of a function operate in constant time?

Suppose we have a function that takes $n$ parameters, each being one bit in size, and returns a single bit. Internally, this function has a bit string $N \in \{0, 1\}^{2^n}$ and it operates by using ...

timing-attack

asked Jan 18 '18 at 22:37

Melab

1,5361 gold badge12 silver badges27 bronze badges

7

votes

1answer

419 views

Does a conditional statement depending on a round number introduce timing attack problems?

In a cryptographic implementation I’m playing with, there’s a round function which includes a conditional if statement. Stripping the superfluous stuff, the C ...

algorithm-design implementation timing-attack

asked Dec 16 '17 at 18:00

e-sushi

14.3k9 gold badges67 silver badges186 bronze badges

0

votes

1answer

295 views

Cache Timing Attack SHA-3

I’ve been tinkering with SHA-3 for a little bit, and I have some questions regarding the applicability of cache timing attacks on this particular hash function. The two sub functions that I believe ...

implementation sha-3 timing-attack keccak

asked Dec 15 '17 at 0:04

Q-Club

1

6

votes

3answers

779 views

Why don't table lookups run in constant time?

The Wikipedia article on big O notation says that performing a lookup is a constant time operation. So why are lookup tables susceptible to timing attacks?

complexity s-boxes side-channel-attack timing-attack

asked Nov 29 '17 at 17:00

Melab

1,5361 gold badge12 silver badges27 bronze badges

8

votes

1answer

494 views

What are the implications of a non “constant time” implementations on trusted systems in a non-network scenario?

Assume a scenario where a symmetric encryption algorithm (for example: AES) wasn't implemented in a way it would safeguard against timing attacks. This symmetric encryption implementation is only used ...

aes cryptanalysis attack timing-attack

asked Oct 18 '17 at 12:20

e-sushi

14.3k9 gold badges67 silver badges186 bronze badges

7

votes

2answers

597 views

RSA Timing Attack on “Extra” Montgomery Reduction

In "A practical implementation of the timing attack", the authors take advantage of a timing difference that stems from "extra reductions" that occur when multiplying numbers in the Montgomery form. ...

rsa side-channel-attack timing-attack montgomery-multiplication

asked Oct 13 '17 at 3:13

kkl

1487 bronze badges

8

votes

2answers

318 views

Timing vulnerability of byte array equality test?

Would the following code to test MAC equality leak timing information ? ...

implementation timing-attack

asked Sep 10 '17 at 10:52

chmike

1726 bronze badges

4

votes

1answer

340 views

Dilithium signature scheme and timing attacks – Does the running time actually depend on the secret key?

The paper “CRYSTALS – Dilithium: Digital Signatures from Module Lattices” (by Léo Ducas, Tancrède Lepoint, Vadim Lyubashevsky, Peter Schwabe, Gregor Seiler, and Damien Stehlé) introduces a digital ...

post-quantum-cryptography lattice-crypto side-channel-attack timing-attack

asked Jul 30 '17 at 4:26

Demi

2,4111 gold badge10 silver badges26 bronze badges

26

votes

5answers

3k views

Timing-Safety in JVM-Languages

How is it possible to write timing-safe code in JVM-languages (Java, Scala, Clojure...)? Is it possible to make libraries like BouncyCastle safe against timing-attacks? I know that even in C it is ...

implementation side-channel-attack timing-attack

asked Jul 5 '17 at 14:11

K. Biermann

3304 silver badges10 bronze badges

3

votes

1answer

105 views

Does the timing of cycle-walking pose a threat?

Cycle-walking is a technique for format-preserving encryption that involves repeating an encryption process until the result is inside a desired range. For example, given an input P, a range R, and ...

cryptanalysis timing-attack format-preserving

asked Jul 2 '17 at 1:02

Daffy

1,5626 silver badges23 bronze badges

1

vote

1answer

455 views

Implementation of a side channel attack? [closed]

As homework I need to find the password of a crackme in ascii-coded binary. We were also given a specific part of the crackme (in the image below), which we will need to use a side channel attack ...

side-channel-attack timing-attack

asked May 16 '17 at 11:26

naspar

61 bronze badge

9

votes

2answers

780 views

Are lookup tables safe when they fit in a cache line?

The typical cache line size of modern x86 machines is 64 bytes. Is it safe to use lookup tables with secret data if the table does not exceed the cache line size, and is aligned accordingly? I was ...

implementation gcm timing-attack

asked Jan 24 '17 at 0:09

Myria

1,0455 silver badges14 bronze badges

3

votes

1answer

126 views

Is having AES tables on a distinct physical page enough to avoid cache timing attacks?

Reading about typical cache timing attacks, they seem to be based on intentional eviction of cache lines and timing how long an operation takes. It seems as if those attacks rely upon these tables ...

aes side-channel-attack timing-attack

asked Jan 5 '17 at 23:46

Myria

1,0455 silver badges14 bronze badges

49

votes

2answers

10k views

Timing attack and good coding practices

How would timing attack occur on a particular code but not in another code (because of good coding practice)? Could anyone give an example? I am having trouble figuring out how timing attacks would ...

timing-attack

asked Nov 21 '16 at 6:52

asdfasd

2464 silver badges3 bronze badges

2

votes

1answer

612 views

Is timing analysis attack the same as cache timing attack?

I am working on an essay on timing attacks on DES but then i have seen resources mostly about cache timing attacks. so is timing analysis attack the same as cache timing?

des timing-attack

asked Nov 20 '16 at 16:38

johndoe12

111 bronze badge

0

votes

1answer

220 views

How long would it take on average to perform a timing attack on HMAC over brute forcing a 32bit tag if the hash is good?

How long would it take on average to perform a timing attack on HMAC over brute forcing a 32bit tag if the hash is good? For example, let's take the hash: 79b7cdc3 to calculate the first byte you ...

cryptanalysis hmac brute-force-attack attack timing-attack

asked Nov 19 '16 at 11:43

NoDirection

345 bronze badges

2

votes

1answer

2k views

Side Channel Attacks

How to make cipher resist against Side channel Attacks. Specially Timing Attack, Cachet Timing Attach, Simple/ Differential Power Analysis. Uptil now it seems all Standard Algorithms like AES, ...

aes side-channel-attack timing-attack camellia

asked Nov 11 '16 at 6:32

khan

1,3009 silver badges20 bronze badges

1

vote

0answers

140 views

Kocher Timing Attack - Error Correction

In class, we learned the Kocher Timing Attacke on modular exponentiation. For determining whether the (e.g., LSB) is 0 or 1, we specified two values: $T_1 = T_M - (TMult(1, y) + (\omega -1)ExpTMult)$ ...

timing-attack

asked Oct 4 '16 at 12:24

Christine

1734 bronze badges

3

votes

1answer

690 views

Is it necessary to worry about timing attacks when comparing SHA256 or Argon2 hashes?

It seems to me that a timing-safe way to compare any two strings is to take a secure hash of both of them and then compare the result. I would expect that the initial hashing would render any timing ...

sha-256 timing-attack argon2

asked Oct 4 '16 at 2:17

Demi

2,4111 gold badge10 silver badges26 bronze badges

3

votes

1answer

159 views

Working Precision and Time-constant Arithmetic with ECC?

I am interested in Elliptic Curve Cryptography and found algorithms for constant-time multiplication. Within these algorithms arithmetic operations must be performed (like addition and multiplication)....

elliptic-curves timing-attack

asked Aug 30 '16 at 20:31

user3637203

1283 bronze badges

5

votes

3answers

125 views

Adding a number congruent to $0$ to ensure that the mod operation takes a constant number of instruction cycles

I've been looking at the s2n implementation of HMAC, and in the `update' function (line 175), it says ...

hmac implementation modular-arithmetic timing-attack

asked Aug 30 '16 at 10:42

man_in_green_shirt

1354 bronze badges

12

votes

1answer

3k views

Why not use `<`, `>` or `==` in constant time comparison?

I am comparing secret data stored in arrays a and b to see which holds a greater value. My current (pseudo)code looks like this:...

side-channel-attack timing-attack

asked Aug 17 '16 at 18:58

Sebastian

1151 silver badge5 bronze badges

3

votes

0answers

94 views

Attacking Scrypt Under Access Pattern Leakage

Could cache-timing channels (such as exist for certain block ciphers) somehow be made use of in order to extract memory-access pattern information if both the attacker and user are NOT in a shared ...

scrypt memory-hard timing-attack

asked Jun 24 '16 at 14:26

McJohnson

531 silver badge3 bronze badges

12

votes

1answer

990 views

Is it possible to test implementation for side-channel attacks?

When it comes to implementing cryptographic algorithms, there seems to be a big focus on the difficulty of doing so without introducing the potential for side channel attacks and the knowledge ...

implementation side-channel-attack timing-attack

asked Jun 23 '16 at 1:52

DasIch

1635 bronze badges

5

votes

1answer

301 views

Do key-dependent S-boxes make efficient constant-time software implementations almost impossible?

It seems to me that algorithms like Blowfish and Twofish with key-dependent S-boxes are almost impossible to implement without table lookups, and thus are almost impossible to implement in software ...

s-boxes timing-attack

asked May 24 '16 at 2:22

Demi

2,4111 gold badge10 silver badges26 bronze badges

11

votes

2answers

472 views

Do I need to worry about timing attacks in Base64 encoding/decoding of private keys?

Do I need to worry about timing attacks in Base64 encoding/decoding of private keys? This is a common operation (ex. PEM keys) and is variable time in typical implementations.

keys timing-attack encoding

asked May 23 '16 at 6:15

Demi

2,4111 gold badge10 silver badges26 bronze badges

1

vote

1answer

167 views

Single-scalar multiplication with sign bit

I want to know if there's an "easy" timing-free way to compute the sign of $y$-coordinate of $r G$, for a secret scalar $r$ and $G$ the generator of an elliptic curve. We have several choices for ...

elliptic-curves signature ed25519 timing-attack schnorr-signature

asked May 17 '16 at 19:05

Nicholas Wilson

1084 bronze badges

2

votes

2answers

193 views

is accessing elements of an array in secret order vulnerable to timing attack?

Suppose there is an array containing bytes 0...255. Suppose this array is shuffled using a key for random data. Since this is indexing the elements of a table using secret data, is it vulnerable to ...

timing-attack

asked Apr 22 '16 at 5:29

Ella Rose♦

17.6k4 gold badges45 silver badges86 bronze badges

5

votes

1answer

253 views

How exploitable are cache timing attacks?

So there's a recent PHP package that has been written to protect against cache timing attacks, which can be seen here . My question is... just how exploitable are cache timing attacks? My overall ...

timing-attack

asked Mar 12 '16 at 15:09

neubert

1,47215 silver badges31 bronze badges

4

votes

1answer

57 views

Is it okay to use a variable-time RSA implementation to verify TLS certificates?

RSA as implemented by OpenSSL et al. needs to protect against side channel attacks, at a big performance penalty. However, TLS certificate validation involves no secrets. Therefore, I should be able ...

rsa tls side-channel-attack timing-attack

asked Mar 11 '16 at 5:42

Demi

2,4111 gold badge10 silver badges26 bronze badges

3

votes

1answer

92 views

Are timing attacks exploitable if each key is used only once?

Suppose that one performs (for example) AES-GCM encryption and decryption using an algorithm that is vulnerable to timing attacks, but each key is used only once. Is it still possible to perform a ...

timing-attack

asked Feb 24 '16 at 23:26

Demi

2,4111 gold badge10 silver badges26 bronze badges

4

votes

1answer

360 views

ChaCha20 immune to timing attacks

What are the reasons because of which ChaCha20 is immune to timing attacks ? Also why is not AES immune to timing attacks?

aes side-channel-attack timing-attack chacha

asked Feb 23 '16 at 17:48

Shridhar R Kulkarni

2524 silver badges9 bronze badges

0

votes

0answers

37 views

Is it okay to bail out early when length mismatch is detected?

Is it okay to bail out early when length mismatch is detected? Specifically, when verifying authenticated encryption, is it okay to bail out early if the wrong amount of ciphertext or the wrong ...

authentication authenticated-encryption timing-attack

asked Feb 23 '16 at 2:30

Demi

2,4111 gold badge10 silver badges26 bronze badges

0

votes

0answers

165 views

Importance of timing attack resistance with AES

I've implemented AES in my library with several variations: a straight C version, a version using x86 SSSE3, and a version using x86 AES-NI. The SSSE3 and AES-NI implementations are constant-time, ...

aes timing-attack

asked Feb 18 '16 at 5:22

Myria

1,0455 silver badges14 bronze badges

1

vote

2answers

201 views

Are there any disadvantages of using libsodiums helpers for en-/decoding/comparision instead of the native ones?

Libsodium has some helpers, which allow hexdecimal decoding, encoding and also constant-time string comparison. So if you use the php binding libsodium-php you ...

side-channel-attack timing-attack libsodium

asked Jan 14 '16 at 16:44

rugk

1154 bronze badges

1

vote

1answer

86 views

Would buffering socket send resist timing attacks

I have been reading and thinking about timing attacks on cryptographic systems. The answer to this question mentions the following: "The way to defend against timing attacks is to make sure the time ...

implementation timing-attack

asked Jan 1 '16 at 21:48

Ella Rose♦

17.6k4 gold badges45 silver badges86 bronze badges

3

votes

1answer

829 views

RSA: Most significant key bit always 1?

Is it possible to say that the most significant bit of an RSA private exponent is always 1? Wouldn't that weaken the key strength by exactly that one bit? I refer to the paper "Timing Attack: What ...

rsa keys timing-attack

asked Nov 28 '15 at 20:40

pafodie

163 bronze badges

Questions tagged [timing-attack]

Related Tags