Skip to main content
New
Stack Overflow Jobs powered by Indeed: A job site that puts thousands of tech jobs at your fingertips (U.S. only). Search jobs

Questions tagged [timing-attack]

The side channel attack is based on the fact that the time difference between certain operations executed by the implementation of a cryptographic scheme allow an adversary to get information that he didn't have according to the theoretical specification of the scheme.

Filter by
Sorted by
Tagged with
0 votes
2 answers
117 views

Has garbage-collection been used for side-channel attacks?

I'm thinking of cryptographic implementations on garbage-collected (gc) languages/runtimes and that the gc process can be potentially dangerous for an implementation even if the implementation has the ...
tur11ng's user avatar
  • 962
1 vote
3 answers
130 views

Is an if-else calling same function(s) vulnerable to side channel attacks

If I have a function f(x, y) and g(x, y) and f and g a are constant time, is the following code vulnerable to side channel ...
Rabool's user avatar
  • 13
0 votes
1 answer
73 views

Does a secret-dependent order of access of a lookup table create a possibility for a timing attack?

There are attacks that can extract some information from lookup table access that depends on a secret value, e.g. if we access a[0] or ...
fjarri's user avatar
  • 289
2 votes
3 answers
2k views

Multiplication implemented in c++ with constant time

I'm considering some non-cryptographic PRNG which uses multiplication of two 64-bit or 128-bit random numbers at some point. ...
Tom's user avatar
  • 1,221
1 vote
1 answer
92 views

Constant-time decompression on an elliptic curve

Let $E\!: y^2 = f(x)$ be an elliptic curve over a finite field $\mathbb{F}_{q}$ of odd characteristic. Consider an $\mathbb{F}_{q}$-point $P = (x,y)$ on $E$. Suppose that we only have the $x$-...
Dimitri Koshelev's user avatar
1 vote
1 answer
95 views

Are you aware of cryptographic contexts (e.g., post-quantum) in which a square root $\sqrt{\cdot}$ must be computed in constant time?

Let $\mathbb{F}_q$ be a finite field of odd characteristic. I know that a constant-time implementation of the square root extraction $\sqrt{\cdot} \in \mathbb{F}_q$ is used in the context of hashing ...
Dimitri Koshelev's user avatar
5 votes
1 answer
689 views

Resistance against timing attacks of AES candidates

It's difficult to implement AES securely and efficiently if the adversary can observe the timing and (approximate) location of memory accesses, unless you have dedicated hardware. The naive ...
Gilles 'SO- stop being evil''s user avatar
1 vote
1 answer
83 views

How new cache designs stop cache-based side channel attacks

How do new cache designs aid in defending against cache-based side-channel attacks? While conducting a side-channel attack, we have the T-table/S-virtual box's address. Normally, address mapping is ...
nivedita's user avatar
8 votes
1 answer
707 views

Is constant-time compare really required for AEAD ciphers?

When verifying a (HMAC) authentication tag it is often indicated that a constant-time comparison is required for security. I can see how leaking information about a password hash can introduce a mild ...
Maarten Bodewes's user avatar
0 votes
1 answer
93 views

Constant time empty string validation

Checks for null require an == check. If you have a string secret (say a hex-encoded key) and you want to check it's empty for validation should you compare it to <...
Oliver Riley's user avatar
11 votes
3 answers
1k views

Is If/else vulnerable to timing side-channel attacks?

I have a branching in c++: if (x & 1) { x = function_1(x); } else { x = function_2(x); } If function_1 and ...
Tom's user avatar
  • 1,221
0 votes
1 answer
136 views

AES XEX Mode: Cache-attacks demonstrated?

Assume AES in XEX mode, so we encrypt a plaintext $x$ as $E_K[x \oplus k_1] \oplus k_2$ where $E_K$ is the usual AES Block cipher (assume $x$ is of block size). Assume the implementation of AES is ...
BlockchainThomas's user avatar
21 votes
8 answers
6k views

How can I understand whether my C implementation is constant-time or not (i.e. resistant to timing attacks)

I have a code for polynomial multiplication and it is written in C. I heard that whether a particular instruction is "constant time" can vary by architecture and by processor model and there ...
esra's user avatar
  • 869
1 vote
1 answer
268 views

Timing attacks: Symmetric vs Asymmetric Algorithms

There is a statement that I can't give a reference; "Since the timing characteristics of symmetric algorithms are not as key dependent as asymmetric algorithms, they are more resistant against ...
NB_1907's user avatar
  • 640
1 vote
0 answers
174 views

How is the Argon2d side channel attack performed?

How should the adversary behave in order to perform a successful side channel attack against Argon2d? I'm trying to understand the scenario that Argon2i tries to resist against.
caveman's user avatar
  • 573
0 votes
1 answer
231 views

Chinese remainder theorem in ECDSA for parameters in secp256k1?

It is known that it is possible to apply the Chinese remainder theorem and attack RSA under precise conditions. https://tls.mbed.org/public/WSchindler-...
JDop's user avatar
  • 3
1 vote
2 answers
187 views

Why is implementation relevant to timing attacks?

Discussions from highly respected sources (details below) emphasize the importance of the implementation of cryptographic software to the effective security provided, with one particular case being ...
Joshua Honig's user avatar
1 vote
1 answer
188 views

How feasible is it to guess the private key of libsodium by taking into account generation time?

So suppose you are doing this locally (so no network noise), and know the exact specifics of your processor too. Is it feasible to figure out the private key (while having access to the public-key) ...
Hormoz's user avatar
  • 799
3 votes
1 answer
155 views

How to ensure that a cryptographic implementation is reasonably sound/robust?

I know from the bottom of my heart how bad the idea of custom-crypto is. I absolutely concur with the recommendation that it should only be done by professionals who specialize in implementing crypto ...
krkhan's user avatar
  • 87
3 votes
3 answers
1k views

Constant time comparison for arrays of different lengths

I found the following code snippet from the Bouncy Castle C# library, which seems to claim that it's constant time, even when the arrays have different lengths. ...
Jeremy's user avatar
  • 31
4 votes
1 answer
603 views

Constant Time Multiplication for Cryptography in Pure Software without Hardware Multiplier or Barrel Shifter

To prevent various forms of timing side-channel attacks, it's strongly advisable to implementing public-key cryptography in constant time. Or at least, without secret-dependent timing variations. ...
比尔盖子's user avatar
3 votes
1 answer
107 views

Is is safe to use MtEtM? (MAC-then-Encrypt and Encrypt-than-MAC)

Assuming I am using different secrets/keys for each MAC pass, does running both MtE and EtM creates any vulnerability? This is what I mean about doing MtEtM: ...
gjvnq's user avatar
  • 131
6 votes
1 answer
542 views

Adapting RSA Timing Attack for Square And Multiply from right-to-left vs left-to-right

I'm trying to reconstruct the fairly well-known RSA timing attack by Kocher. I'm working with simulated timing data, so I have completely noise-free "measurements". My attack is successful ...
Richard's user avatar
  • 71
13 votes
1 answer
2k views

Safely sorting secret data

Suppose you have a secret list of n distinct integers. How would you sort this list in a way that is not vulnerable to timing attacks? I tried looking up "...
Kai Arakawa's user avatar
2 votes
1 answer
704 views

Is AES without T-Tables nor S-Box resistant to side-channel?

T-Tables and S-Boxes are prone to side-channel attacks, is an implementation without any lookup tables resistant to side-channel ? In this answer, https://crypto.stackexchange.com/a/63520/80926, the ...
moutonlapin28's user avatar
0 votes
0 answers
179 views

Can someone explain the timing attack on RSA with Montgomery multiplication?

I have read several articles on the temporal attack against Montgomery multiplication to speedup RSA computations. However, I do not quite get the principle. I understood that there is a additional ...
Black cryptographer's user avatar
9 votes
1 answer
2k views

How to confirm my implementation is constant time

I'm implementing Schnorr signatures following a variant used in Bitcoin Cash (BCH) of this algorithm: GitHub - Schnorr Signatures for secp256k1. A notable difference is that the BCH schnorr algorithm ...
user avatar
4 votes
2 answers
694 views

Mitigating timing attacks with a random sleep

Could you mitigate all timing attacks by putting a sleep(random()) with a naive crypto implementation? Eg if your implementation looks solid, but you're not sure what the next CPU cache vulnerability ...
Chris's user avatar
  • 143
0 votes
1 answer
720 views

How to make an AES implementation using lookup tables immune to cache timing attacks?

I recently made a very naive implementation of AES using lookup tables, but it's totally unsafe because of timing attacks. I am not interested in using the processor specific instructions for AES, ...
Aravind A's user avatar
  • 1,030
1 vote
0 answers
504 views

Question about RSA timing attack and a Chosen Ciphertext Attack on RSA

I am quite new to the RSA and I have a couple of questions that confuse me. Q1: A Timing attack on RSA can be prevented _____________________________ A. By performing the “square and multiply” ...
Godfrey's user avatar
  • 11
0 votes
0 answers
61 views

exfiltrating salts with timing attacks?

It seems to me that it's theoretically possible to exfiltrate a salt against a hashing algorithm that isn't constant time using specially crafted inputs. Are there any examples of this being done in ...
Daniel Hill's user avatar
1 vote
0 answers
159 views

Side channel attack: Why building an eviction set is possible?

I'm learning about the side channel attack on the cache. I came to know that most of the attack (EVICT + TIME, PRIME + PROBE, PRIME + ABORT) on the cache is initiated by building an eviction set(a ...
randomUser's user avatar
0 votes
0 answers
77 views

One time code appended to password

Apologies in advance, I'm a beginner and my knowledge of terminology in this field probably reflects that. I have a question about one-time codes being used with passwords. What inspires me to ask ...
MadisonCooper's user avatar
2 votes
0 answers
75 views

RSA: Blinding versus fixed-time computation

For RSA, what is the standard solution against timing attacks? I know about RSA blinding as one solution. Another solution is to always compute both the squared value and square-and-multiply values, ...
Myria's user avatar
  • 2,575
2 votes
2 answers
1k views

The attacker model of the Lucky13 attack in TLS

Lucky13 is a timing attack against the MAC in the CBC MAC-then-encrypt ciphersuites. In the attack's page: The attacks involve detecting small differences in the time at which TLS error messages ...
user9371654's user avatar
1 vote
1 answer
124 views

obscuring timing attacks in vulnerable libraries

Let's say you're using a library that you know is vulnerable to timing attacks. Short of switching libraries all together it seems to me that putting a sleep in the ...
neubert's user avatar
  • 2,937
4 votes
1 answer
267 views

Synthetic Jitter to Combat Timing Attacks

We are working on some tooling. It has a networking kernel. We would like to think that jitter built into the kernel would help with timing attacks? Is this true?
cryptoJim's user avatar
2 votes
0 answers
96 views

Is timing attack practical in a web developer's perspective?

Let's say my server has a non-constant-time compare function for checking if the visitor has a valid session id. The time it takes for the comparator to run would be very insignificant, usually within ...
longcc's user avatar
  • 21
2 votes
1 answer
45 views

How does failing to square a value in this version libcrypt++ cause a timing attack vulnerability?

I'm a crypto beginner and reading about blinding, and my fundamental understanding about preventing timing attacks is that you need to sort of process information in a way that will produce similar ...
john doe's user avatar
  • 123
4 votes
1 answer
410 views

GCM mode GHASH sensitivity to timing attacks

In GCM mode of authenticated encryption, is it a security concern if the GHASH implementation timing can vary? If the timing varies according to the AAD/ciphertext data, it looks as though that doesn'...
Craig McQueen's user avatar
3 votes
3 answers
291 views

Hashing items of different Bytes but same length would enable a timing attack?

I am following this paper which comes highly recommended as a secure Registration/Login system over TLS which uses client side computation for the Password Processing Function (PPF). What my main ...
Lolu Gewub's user avatar
6 votes
2 answers
2k views

Constant time implementations of crypto algorithms

To protect against cache attacks (side channel attacks) generally constant time crypto implementations are advised. In some cases DJB released new algorithms (chacha) that are designed with this in ...
stflow's user avatar
  • 83
10 votes
1 answer
504 views

AES cache-timing attacks and nonce-based operation modes

As I understand it, AES cache-timing attacks exploit the execution time variations due to cache hits/misses, especially the ones depending on the SBox look-up tables which are key-related. To mount ...
Raoul722's user avatar
  • 2,836
2 votes
1 answer
277 views

should one worry about timing attacks with signature verification?

To compare two varablies in such a way that timing attacks don't exist it's generally recommended you pad the strings to the same length and then look at each byte, even if an earlier byte was ...
neubert's user avatar
  • 2,937
2 votes
3 answers
1k views

Does this implementation of a function operate in constant time?

Suppose we have a function that takes $n$ parameters, each being one bit in size, and returns a single bit. Internally, this function has a bit string $N \in \{0, 1\}^{2^n}$ and it operates by using ...
Melab's user avatar
  • 3,655
7 votes
1 answer
457 views

Does a conditional statement depending on a round number introduce timing attack problems?

In a cryptographic implementation I’m playing with, there’s a round function which includes a conditional if statement. Stripping the superfluous stuff, the C ...
e-sushi's user avatar
  • 17.9k
0 votes
1 answer
518 views

Cache Timing Attack SHA-3

I’ve been tinkering with SHA-3 for a little bit, and I have some questions regarding the applicability of cache timing attacks on this particular hash function. The two sub functions that I believe ...
Q-Club's user avatar
  • 1
7 votes
3 answers
3k views

Why don't table lookups run in constant time?

The Wikipedia article on big O notation says that performing a lookup is a constant time operation. So why are lookup tables susceptible to timing attacks?
Melab's user avatar
  • 3,655
8 votes
1 answer
635 views

What are the implications of a non “constant time” implementations on trusted systems in a non-network scenario?

Assume a scenario where a symmetric encryption algorithm (for example: AES) wasn't implemented in a way it would safeguard against timing attacks. This symmetric encryption implementation is only used ...
e-sushi's user avatar
  • 17.9k
8 votes
2 answers
2k views

RSA Timing Attack on "Extra" Montgomery Reduction

In "A practical implementation of the timing attack", the authors take advantage of a timing difference that stems from "extra reductions" that occur when multiplying numbers in the Montgomery form. ...
kkl's user avatar
  • 383