Newest 'timing-attack' Questions

2

votes

1answer

109 views

How to ensure that a cryptographic implementation is reasonably sound/robust?

I know from the bottom of my heart how bad the idea of custom-crypto is. I absolutely concur with the recommendation that it should only be done by professionals who specialize in implementing crypto ...

asked Mar 12 at 21:15

krkhan

635 bronze badges

2

votes

2answers

92 views

Constant time comparison for arrays of different lengths

I found the following code snippet from the Bouncy Castle C# library, which seems to claim that it's constant time, even when the arrays have different lengths. ...

timing-attack

asked Feb 19 at 13:49

Jeremy

211 bronze badge

4

votes

1answer

460 views

Constant Time Multiplication for Cryptography in Pure Software without Hardware Multiplier or Barrel Shifter

To prevent various forms of timing side-channel attacks, it's strongly advisable to implementing public-key cryptography in constant time. Or at least, without secret-dependent timing variations. ...

timing-attack

asked Feb 8 at 5:24

比尔盖子

815 bronze badges

2

votes

1answer

53 views

Is is safe to use MtEtM? (MAC-then-Encrypt and Encrypt-than-MAC)

Assuming I am using different secrets/keys for each MAC pass, does running both MtE and EtM creates any vulnerability? This is what I mean about doing MtEtM: ...

encryption hmac timing-attack

asked Nov 30 '20 at 12:05

gjvnq

1211 bronze badge

6

votes

1answer

122 views

Adapting RSA Timing Attack for Square And Multiply from right-to-left vs left-to-right

I'm trying to reconstruct the fairly well-known RSA timing attack by Kocher. I'm working with simulated timing data, so I have completely noise-free "measurements". My attack is successful ...

rsa timing-attack

asked Aug 23 '20 at 23:31

Richard

712 bronze badges

13

votes

1answer

2k views

Safely sorting secret data

Suppose you have a secret list of n distinct integers. How would you sort this list in a way that is not vulnerable to timing attacks? I tried looking up "...

side-channel-attack timing-attack

asked Jul 9 '20 at 21:08

Kai Arakawa

1459 bronze badges

2

votes

1answer

154 views

Is AES without T-Tables nor S-Box resistant to side-channel?

T-Tables and S-Boxes are prone to side-channel attacks, is an implementation without any lookup tables resistant to side-channel ? In this answer, https://crypto.stackexchange.com/a/63520/80926, the ...

aes cryptanalysis side-channel-attack timing-attack

asked Jun 26 '20 at 1:36

moutonlapin28

3037 bronze badges

0

votes

0answers

67 views

Can someone explain the timing attack on RSA with Montgomery multiplication?

I have read several articles on the temporal attack against Montgomery multiplication to speedup RSA computations. However, I do not quite get the principle. I understood that there is a additional ...

rsa cryptanalysis attack timing-attack montgomery-multiplication

asked May 10 '20 at 3:34

Black cryptographer

112 bronze badges

8

votes

1answer

2k views

How to confirm my implementation is constant time

I'm implementing Schnorr signatures following a variant used in Bitcoin Cash (BCH) of this algorithm: GitHub - Schnorr Signatures for secp256k1. A notable difference is that the BCH schnorr algorithm ...

side-channel-attack timing-attack schnorr-signature

asked May 6 '20 at 3:54

sken

895 bronze badges

2

votes

2answers

215 views

Mitigating timing attacks with a random sleep

Could you mitigate all timing attacks by putting a sleep(random()) with a naive crypto implementation? Eg if your implementation looks solid, but you're not sure what the next CPU cache vulnerability ...

timing-attack

asked Feb 13 '20 at 0:32

Chris

1235 bronze badges

0

votes

1answer

239 views

How to make an AES implementation using lookup tables immune to cache timing attacks?

I recently made a very naive implementation of AES using lookup tables, but it's totally unsafe because of timing attacks. I am not interested in using the processor specific instructions for AES, ...

aes timing-attack

asked Jan 12 '20 at 14:10

Vivekanand V

8283 silver badges11 bronze badges

1

vote

0answers

282 views

Question about RSA timing attack and a Chosen Ciphertext Attack on RSA

I am quite new to the RSA and I have a couple of questions that confuse me. Q1: A Timing attack on RSA can be prevented _____________________________ A. By performing the “square and multiply” ...

encryption rsa cryptanalysis timing-attack

asked Nov 11 '19 at 19:54

Godfrey

112 bronze badges

0

votes

0answers

37 views

exfiltrating salts with timing attacks?

It seems to me that it's theoretically possible to exfiltrate a salt against a hashing algorithm that isn't constant time using specially crafted inputs. Are there any examples of this being done in ...

password-hashing timing-attack

asked Nov 11 '19 at 6:51

Daniel Hill

1404 bronze badges

1

vote

0answers

90 views

Side channel attack: Why building an eviction set is possible?

I'm learning about the side channel attack on the cache. I came to know that most of the attack (EVICT + TIME, PRIME + PROBE, PRIME + ABORT) on the cache is initiated by building an eviction set(a ...

side-channel-attack timing-attack cpu

asked Jun 13 '19 at 2:15

randomUser

211 bronze badge

0

votes

0answers

41 views

One time code appended to password

Apologies in advance, I'm a beginner and my knowledge of terminology in this field probably reflects that. I have a question about one-time codes being used with passwords. What inspires me to ask ...

timing-attack one-time-password

asked Mar 29 '19 at 18:31

MadisonCooper

101

2

votes

0answers

55 views

RSA: Blinding versus fixed-time computation

For RSA, what is the standard solution against timing attacks? I know about RSA blinding as one solution. Another solution is to always compute both the squared value and square-and-multiply values, ...

rsa side-channel-attack timing-attack

asked Mar 20 '19 at 22:02

Myria

1,7556 silver badges17 bronze badges

2

votes

2answers

978 views

The attacker model of the Lucky13 attack in TLS

Lucky13 is a timing attack against the MAC in the CBC MAC-then-encrypt ciphersuites. In the attack's page: The attacks involve detecting small differences in the time at which TLS error messages ...

tls cbc openssl cbc-mac timing-attack

asked Oct 27 '18 at 21:22

user9371654

3073 silver badges9 bronze badges

1

vote

1answer

100 views

obscuring timing attacks in vulnerable libraries

Let's say you're using a library that you know is vulnerable to timing attacks. Short of switching libraries all together it seems to me that putting a sleep in the ...

timing-attack

asked Sep 26 '18 at 19:37

neubert

2,5691 gold badge21 silver badges38 bronze badges

4

votes

1answer

201 views

Synthetic Jitter to Combat Timing Attacks

We are working on some tooling. It has a networking kernel. We would like to think that jitter built into the kernel would help with timing attacks? Is this true?

randomness timing-attack

asked Aug 12 '18 at 17:44

cryptoJim

512 bronze badges

2

votes

0answers

80 views

Is timing attack practical in a web developer's perspective?

Let's say my server has a non-constant-time compare function for checking if the visitor has a valid session id. The time it takes for the comparator to run would be very insignificant, usually within ...

authentication timing-attack

asked Aug 11 '18 at 10:03

longcc

211 bronze badge

1

vote

1answer

38 views

How does failing to square a value in this version libcrypt++ cause a timing attack vulnerability?

I'm a crypto beginner and reading about blinding, and my fundamental understanding about preventing timing attacks is that you need to sort of process information in a way that will produce similar ...

timing-attack

asked Jul 30 '18 at 13:30

john doe

1133 bronze badges

3

votes

1answer

277 views

GCM mode GHASH sensitivity to timing attacks

In GCM mode of authenticated encryption, is it a security concern if the GHASH implementation timing can vary? If the timing varies according to the AAD/ciphertext data, it looks as though that doesn'...

gcm timing-attack

asked May 29 '18 at 2:28

Craig McQueen

2522 silver badges8 bronze badges

2

votes

3answers

230 views

Hashing items of different Bytes but same length would enable a timing attack?

I am following this paper which comes highly recommended as a secure Registration/Login system over TLS which uses client side computation for the Password Processing Function (PPF). What my main ...

hash password-hashing timing-attack

asked Mar 26 '18 at 2:57

Lolu Gewub

212 bronze badges

4

votes

2answers

1k views

Constant time implementations of crypto algorithms

To protect against cache attacks (side channel attacks) generally constant time crypto implementations are advised. In some cases DJB released new algorithms (chacha) that are designed with this in ...

side-channel-attack cryptographic-hardware timing-attack

asked Mar 12 '18 at 1:56

stflow

634 bronze badges

10

votes

1answer

336 views

AES cache-timing attacks and nonce-based operation modes

As I understand it, AES cache-timing attacks exploit the execution time variations due to cache hits/misses, especially the ones depending on the SBox look-up tables which are key-related. To mount ...

aes gcm timing-attack ccm

asked Feb 23 '18 at 10:38

Raoul722

2,5572 gold badges13 silver badges34 bronze badges

2

votes

1answer

166 views

should one worry about timing attacks with signature verification?

To compare two varablies in such a way that timing attacks don't exist it's generally recommended you pad the strings to the same length and then look at each byte, even if an earlier byte was ...

public-key signature dsa timing-attack

asked Feb 10 '18 at 22:09

neubert

2,5691 gold badge21 silver badges38 bronze badges

2

votes

3answers

1k views

Does this implementation of a function operate in constant time?

Suppose we have a function that takes $n$ parameters, each being one bit in size, and returns a single bit. Internally, this function has a bit string $N \in \{0, 1\}^{2^n}$ and it operates by using ...

timing-attack

asked Jan 18 '18 at 22:37

Melab

3,2172 gold badges17 silver badges35 bronze badges

7

votes

1answer

441 views

Does a conditional statement depending on a round number introduce timing attack problems?

In a cryptographic implementation I’m playing with, there’s a round function which includes a conditional if statement. Stripping the superfluous stuff, the C ...

algorithm-design implementation timing-attack

asked Dec 16 '17 at 18:00

e-sushi

17k12 gold badges70 silver badges205 bronze badges

0

votes

1answer

396 views

Cache Timing Attack SHA-3

I’ve been tinkering with SHA-3 for a little bit, and I have some questions regarding the applicability of cache timing attacks on this particular hash function. The two sub functions that I believe ...

implementation sha-3 timing-attack keccak

asked Dec 15 '17 at 0:04

Q-Club

1

7

votes

3answers

1k views

Why don't table lookups run in constant time?

The Wikipedia article on big O notation says that performing a lookup is a constant time operation. So why are lookup tables susceptible to timing attacks?

complexity s-boxes side-channel-attack timing-attack

asked Nov 29 '17 at 17:00

Melab

3,2172 gold badges17 silver badges35 bronze badges

8

votes

1answer

522 views

What are the implications of a non “constant time” implementations on trusted systems in a non-network scenario?

Assume a scenario where a symmetric encryption algorithm (for example: AES) wasn't implemented in a way it would safeguard against timing attacks. This symmetric encryption implementation is only used ...

aes cryptanalysis attack timing-attack

asked Oct 18 '17 at 12:20

e-sushi

17k12 gold badges70 silver badges205 bronze badges

7

votes

2answers

983 views

RSA Timing Attack on “Extra” Montgomery Reduction

In "A practical implementation of the timing attack", the authors take advantage of a timing difference that stems from "extra reductions" that occur when multiplying numbers in the Montgomery form. ...

rsa side-channel-attack timing-attack montgomery-multiplication

asked Oct 13 '17 at 3:13

kkl

3431 silver badge7 bronze badges

8

votes

2answers

492 views

Timing vulnerability of byte array equality test?

Would the following code to test MAC equality leak timing information ? ...

implementation timing-attack

asked Sep 10 '17 at 10:52

chmike

2391 silver badge6 bronze badges

4

votes

1answer

385 views

Dilithium signature scheme and timing attacks – Does the running time actually depend on the secret key?

The paper “CRYSTALS – Dilithium: Digital Signatures from Module Lattices” (by Léo Ducas, Tancrède Lepoint, Vadim Lyubashevsky, Peter Schwabe, Gregor Seiler, and Damien Stehlé) introduces a digital ...

post-quantum-cryptography lattice-crypto side-channel-attack timing-attack

asked Jul 30 '17 at 4:26

Demi

4,5111 gold badge15 silver badges34 bronze badges

27

votes

5answers

3k views

Timing-Safety in JVM-Languages

How is it possible to write timing-safe code in JVM-languages (Java, Scala, Clojure...)? Is it possible to make libraries like BouncyCastle safe against timing-attacks? I know that even in C it is ...

implementation side-channel-attack timing-attack

asked Jul 5 '17 at 14:11

K. Biermann

5705 silver badges11 bronze badges

3

votes

1answer

113 views

Does the timing of cycle-walking pose a threat?

Cycle-walking is a technique for format-preserving encryption that involves repeating an encryption process until the result is inside a desired range. For example, given an input P, a range R, and ...

cryptanalysis timing-attack format-preserving

asked Jul 2 '17 at 1:02

Daffy

2,25713 silver badges26 bronze badges

1

vote

1answer

556 views

Implementation of a side channel attack? [closed]

As homework I need to find the password of a crackme in ascii-coded binary. We were also given a specific part of the crackme (in the image below), which we will need to use a side channel attack ...

side-channel-attack timing-attack

asked May 16 '17 at 11:26

naspar

111 bronze badge

9

votes

2answers

884 views

Are lookup tables safe when they fit in a cache line?

The typical cache line size of modern x86 machines is 64 bytes. Is it safe to use lookup tables with secret data if the table does not exceed the cache line size, and is aligned accordingly? I was ...

implementation gcm timing-attack

asked Jan 24 '17 at 0:09

Myria

1,7556 silver badges17 bronze badges

3

votes

1answer

152 views

Is having AES tables on a distinct physical page enough to avoid cache timing attacks?

Reading about typical cache timing attacks, they seem to be based on intentional eviction of cache lines and timing how long an operation takes. It seems as if those attacks rely upon these tables ...

aes side-channel-attack timing-attack

asked Jan 5 '17 at 23:46

Myria

1,7556 silver badges17 bronze badges

52

votes

2answers

12k views

Timing attack and good coding practices

How would timing attack occur on a particular code but not in another code (because of good coding practice)? Could anyone give an example? I am having trouble figuring out how timing attacks would ...

timing-attack

asked Nov 21 '16 at 6:52

asdfasd

5211 gold badge5 silver badges3 bronze badges

2

votes

1answer

871 views

Is timing analysis attack the same as cache timing attack?

I am working on an essay on timing attacks on DES but then i have seen resources mostly about cache timing attacks. so is timing analysis attack the same as cache timing?

des timing-attack

asked Nov 20 '16 at 16:38

johndoe12

211 bronze badge

0

votes

1answer

285 views

How long would it take on average to perform a timing attack on HMAC over brute forcing a 32bit tag if the hash is good?

How long would it take on average to perform a timing attack on HMAC over brute forcing a 32bit tag if the hash is good? For example, let's take the hash: 79b7cdc3 to calculate the first byte you ...

cryptanalysis hmac brute-force-attack attack timing-attack

asked Nov 19 '16 at 11:43

NoDirection

595 bronze badges

3

votes

1answer

2k views

Side Channel Attacks

How to make cipher resist against Side channel Attacks. Specially Timing Attack, Cachet Timing Attach, Simple/ Differential Power Analysis. Uptil now it seems all Standard Algorithms like AES, ...

aes side-channel-attack timing-attack camellia

asked Nov 11 '16 at 6:32

crypt

1,85211 silver badges23 bronze badges

1

vote

0answers

178 views

Kocher Timing Attack - Error Correction

In class, we learned the Kocher Timing Attacke on modular exponentiation. For determining whether the (e.g., LSB) is 0 or 1, we specified two values: $T_1 = T_M - (TMult(1, y) + (\omega -1)ExpTMult)$ ...

timing-attack

asked Oct 4 '16 at 12:24

Christine

3231 silver badge4 bronze badges

5

votes

1answer

1k views

Is it necessary to worry about timing attacks when comparing SHA256 or Argon2 hashes?

It seems to me that a timing-safe way to compare any two strings is to take a secure hash of both of them and then compare the result. I would expect that the initial hashing would render any timing ...

sha-256 timing-attack argon2

asked Oct 4 '16 at 2:17

Demi

4,5111 gold badge15 silver badges34 bronze badges

3

votes

1answer

202 views

Working Precision and Time-constant Arithmetic with ECC?

I am interested in Elliptic Curve Cryptography and found algorithms for constant-time multiplication. Within these algorithms arithmetic operations must be performed (like addition and multiplication)....

elliptic-curves timing-attack

asked Aug 30 '16 at 20:31

user3637203

1533 bronze badges

5

votes

3answers

129 views

Adding a number congruent to $0$ to ensure that the mod operation takes a constant number of instruction cycles

I've been looking at the s2n implementation of HMAC, and in the `update' function (line 175), it says ...

hmac implementation modular-arithmetic timing-attack

asked Aug 30 '16 at 10:42

man_in_green_shirt

1654 bronze badges

14

votes

1answer

3k views

Why not use `<`, `>` or `==` in constant time comparison?

I am comparing secret data stored in arrays a and b to see which holds a greater value. My current (pseudo)code looks like this:...

side-channel-attack timing-attack

asked Aug 17 '16 at 18:58

Sebastian

3992 silver badges6 bronze badges

3

votes

0answers

111 views

Attacking Scrypt Under Access Pattern Leakage

Could cache-timing channels (such as exist for certain block ciphers) somehow be made use of in order to extract memory-access pattern information if both the attacker and user are NOT in a shared ...

scrypt memory-hard timing-attack

asked Jun 24 '16 at 14:26

McJohnson

1231 silver badge3 bronze badges

12

votes

1answer

1k views

Is it possible to test implementation for side-channel attacks?

When it comes to implementing cryptographic algorithms, there seems to be a big focus on the difficulty of doing so without introducing the potential for side channel attacks and the knowledge ...

implementation side-channel-attack timing-attack

asked Jun 23 '16 at 1:52

DasIch

2231 silver badge6 bronze badges

Questions tagged [timing-attack]

Related Tags