New
Stack Overflow Jobs powered by Indeed: A job site that puts thousands of tech jobs at your fingertips (U.S. only). Search jobs

# Questions tagged [timing-attack]

The side channel attack is based on the fact that the time difference between certain operations executed by the implementation of a cryptographic scheme allow an adversary to get information that he didn't have according to the theoretical specification of the scheme.

111 questions
Filter by
Sorted by
Tagged with
117 views

### Has garbage-collection been used for side-channel attacks?

I'm thinking of cryptographic implementations on garbage-collected (gc) languages/runtimes and that the gc process can be potentially dangerous for an implementation even if the implementation has the ...
• 962
1 vote
130 views

### Is an if-else calling same function(s) vulnerable to side channel attacks

If I have a function f(x, y) and g(x, y) and f and g a are constant time, is the following code vulnerable to side channel ...
• 13
73 views

### Does a secret-dependent order of access of a lookup table create a possibility for a timing attack?

There are attacks that can extract some information from lookup table access that depends on a secret value, e.g. if we access a[0] or ...
• 289
2k views

### Multiplication implemented in c++ with constant time

I'm considering some non-cryptographic PRNG which uses multiplication of two 64-bit or 128-bit random numbers at some point. ...
• 1,221
1 vote
92 views

### Constant-time decompression on an elliptic curve

Let $E\!: y^2 = f(x)$ be an elliptic curve over a finite field $\mathbb{F}_{q}$ of odd characteristic. Consider an $\mathbb{F}_{q}$-point $P = (x,y)$ on $E$. Suppose that we only have the $x$-...
1 vote
95 views

### Are you aware of cryptographic contexts (e.g., post-quantum) in which a square root $\sqrt{\cdot}$ must be computed in constant time?

Let $\mathbb{F}_q$ be a finite field of odd characteristic. I know that a constant-time implementation of the square root extraction $\sqrt{\cdot} \in \mathbb{F}_q$ is used in the context of hashing ...
689 views

### Resistance against timing attacks of AES candidates

It's difficult to implement AES securely and efficiently if the adversary can observe the timing and (approximate) location of memory accesses, unless you have dedicated hardware. The naive ...
1 vote
83 views

### How new cache designs stop cache-based side channel attacks

How do new cache designs aid in defending against cache-based side-channel attacks? While conducting a side-channel attack, we have the T-table/S-virtual box's address. Normally, address mapping is ...
• 31
707 views

### Is constant-time compare really required for AEAD ciphers?

When verifying a (HMAC) authentication tag it is often indicated that a constant-time comparison is required for security. I can see how leaking information about a password hash can introduce a mild ...
• 93k
93 views

### Constant time empty string validation

Checks for null require an == check. If you have a string secret (say a hex-encoded key) and you want to check it's empty for validation should you compare it to <...
1k views

### Is If/else vulnerable to timing side-channel attacks?

I have a branching in c++: if (x & 1) { x = function_1(x); } else { x = function_2(x); } If function_1 and ...
• 1,221
136 views

### AES XEX Mode: Cache-attacks demonstrated?

Assume AES in XEX mode, so we encrypt a plaintext $x$ as $E_K[x \oplus k_1] \oplus k_2$ where $E_K$ is the usual AES Block cipher (assume $x$ is of block size). Assume the implementation of AES is ...
6k views

### How can I understand whether my C implementation is constant-time or not (i.e. resistant to timing attacks)

I have a code for polynomial multiplication and it is written in C. I heard that whether a particular instruction is "constant time" can vary by architecture and by processor model and there ...
• 869
1 vote
268 views

### Timing attacks: Symmetric vs Asymmetric Algorithms

There is a statement that I can't give a reference; "Since the timing characteristics of symmetric algorithms are not as key dependent as asymmetric algorithms, they are more resistant against ...
• 640
1 vote
174 views

### How is the Argon2d side channel attack performed?

How should the adversary behave in order to perform a successful side channel attack against Argon2d? I'm trying to understand the scenario that Argon2i tries to resist against.
• 573
231 views

### Chinese remainder theorem in ECDSA for parameters in secp256k1?

It is known that it is possible to apply the Chinese remainder theorem and attack RSA under precise conditions. https://tls.mbed.org/public/WSchindler-...
• 3
1 vote
187 views

### Why is implementation relevant to timing attacks?

Discussions from highly respected sources (details below) emphasize the importance of the implementation of cryptographic software to the effective security provided, with one particular case being ...
• 111
1 vote
188 views

### How feasible is it to guess the private key of libsodium by taking into account generation time?

So suppose you are doing this locally (so no network noise), and know the exact specifics of your processor too. Is it feasible to figure out the private key (while having access to the public-key) ...
• 799
155 views

### How to ensure that a cryptographic implementation is reasonably sound/robust?

I know from the bottom of my heart how bad the idea of custom-crypto is. I absolutely concur with the recommendation that it should only be done by professionals who specialize in implementing crypto ...
• 87
1k views

### Constant time comparison for arrays of different lengths

I found the following code snippet from the Bouncy Castle C# library, which seems to claim that it's constant time, even when the arrays have different lengths. ...
• 31
603 views

### Constant Time Multiplication for Cryptography in Pure Software without Hardware Multiplier or Barrel Shifter

To prevent various forms of timing side-channel attacks, it's strongly advisable to implementing public-key cryptography in constant time. Or at least, without secret-dependent timing variations. ...
• 156
107 views

### Is is safe to use MtEtM? (MAC-then-Encrypt and Encrypt-than-MAC)

Assuming I am using different secrets/keys for each MAC pass, does running both MtE and EtM creates any vulnerability? This is what I mean about doing MtEtM: ...
• 131
542 views

### Adapting RSA Timing Attack for Square And Multiply from right-to-left vs left-to-right

I'm trying to reconstruct the fairly well-known RSA timing attack by Kocher. I'm working with simulated timing data, so I have completely noise-free "measurements". My attack is successful ...
• 71
2k views

### Safely sorting secret data

Suppose you have a secret list of n distinct integers. How would you sort this list in a way that is not vulnerable to timing attacks? I tried looking up "...
• 145
704 views

### Is AES without T-Tables nor S-Box resistant to side-channel?

T-Tables and S-Boxes are prone to side-channel attacks, is an implementation without any lookup tables resistant to side-channel ? In this answer, https://crypto.stackexchange.com/a/63520/80926, the ...
179 views

### Can someone explain the timing attack on RSA with Montgomery multiplication?

I have read several articles on the temporal attack against Montgomery multiplication to speedup RSA computations. However, I do not quite get the principle. I understood that there is a additional ...
2k views

### How to confirm my implementation is constant time

I'm implementing Schnorr signatures following a variant used in Bitcoin Cash (BCH) of this algorithm: GitHub - Schnorr Signatures for secp256k1. A notable difference is that the BCH schnorr algorithm ...
694 views

### Mitigating timing attacks with a random sleep

Could you mitigate all timing attacks by putting a sleep(random()) with a naive crypto implementation? Eg if your implementation looks solid, but you're not sure what the next CPU cache vulnerability ...
• 143
720 views

### How to make an AES implementation using lookup tables immune to cache timing attacks?

I recently made a very naive implementation of AES using lookup tables, but it's totally unsafe because of timing attacks. I am not interested in using the processor specific instructions for AES, ...
• 1,030
1 vote
504 views

### Question about RSA timing attack and a Chosen Ciphertext Attack on RSA

I am quite new to the RSA and I have a couple of questions that confuse me. Q1: A Timing attack on RSA can be prevented _____________________________ A. By performing the “square and multiply” ...
• 11
61 views

### exfiltrating salts with timing attacks?

It seems to me that it's theoretically possible to exfiltrate a salt against a hashing algorithm that isn't constant time using specially crafted inputs. Are there any examples of this being done in ...
• 140
1 vote
159 views

### Side channel attack: Why building an eviction set is possible?

I'm learning about the side channel attack on the cache. I came to know that most of the attack (EVICT + TIME, PRIME + PROBE, PRIME + ABORT) on the cache is initiated by building an eviction set(a ...
77 views

### One time code appended to password

Apologies in advance, I'm a beginner and my knowledge of terminology in this field probably reflects that. I have a question about one-time codes being used with passwords. What inspires me to ask ...
75 views

### RSA: Blinding versus fixed-time computation

For RSA, what is the standard solution against timing attacks? I know about RSA blinding as one solution. Another solution is to always compute both the squared value and square-and-multiply values, ...
• 2,575
1k views

### The attacker model of the Lucky13 attack in TLS

Lucky13 is a timing attack against the MAC in the CBC MAC-then-encrypt ciphersuites. In the attack's page: The attacks involve detecting small differences in the time at which TLS error messages ...
• 417
1 vote
124 views

### obscuring timing attacks in vulnerable libraries

Let's say you're using a library that you know is vulnerable to timing attacks. Short of switching libraries all together it seems to me that putting a sleep in the ...
• 2,937
267 views

### Synthetic Jitter to Combat Timing Attacks

We are working on some tooling. It has a networking kernel. We would like to think that jitter built into the kernel would help with timing attacks? Is this true?
96 views

### Is timing attack practical in a web developer's perspective?

Let's say my server has a non-constant-time compare function for checking if the visitor has a valid session id. The time it takes for the comparator to run would be very insignificant, usually within ...
• 21
45 views

### How does failing to square a value in this version libcrypt++ cause a timing attack vulnerability?

I'm a crypto beginner and reading about blinding, and my fundamental understanding about preventing timing attacks is that you need to sort of process information in a way that will produce similar ...
• 123
410 views

### GCM mode GHASH sensitivity to timing attacks

In GCM mode of authenticated encryption, is it a security concern if the GHASH implementation timing can vary? If the timing varies according to the AAD/ciphertext data, it looks as though that doesn'...
291 views

### Hashing items of different Bytes but same length would enable a timing attack?

I am following this paper which comes highly recommended as a secure Registration/Login system over TLS which uses client side computation for the Password Processing Function (PPF). What my main ...
2k views

### Constant time implementations of crypto algorithms

To protect against cache attacks (side channel attacks) generally constant time crypto implementations are advised. In some cases DJB released new algorithms (chacha) that are designed with this in ...
• 83
504 views

### AES cache-timing attacks and nonce-based operation modes

As I understand it, AES cache-timing attacks exploit the execution time variations due to cache hits/misses, especially the ones depending on the SBox look-up tables which are key-related. To mount ...
• 2,836
277 views

### should one worry about timing attacks with signature verification?

To compare two varablies in such a way that timing attacks don't exist it's generally recommended you pad the strings to the same length and then look at each byte, even if an earlier byte was ...
• 2,937
1k views

### Does this implementation of a function operate in constant time?

Suppose we have a function that takes $n$ parameters, each being one bit in size, and returns a single bit. Internally, this function has a bit string $N \in \{0, 1\}^{2^n}$ and it operates by using ...
• 3,655
457 views

### Does a conditional statement depending on a round number introduce timing attack problems?

In a cryptographic implementation I’m playing with, there’s a round function which includes a conditional if statement. Stripping the superfluous stuff, the C ...
• 17.9k
518 views

### Cache Timing Attack SHA-3

I’ve been tinkering with SHA-3 for a little bit, and I have some questions regarding the applicability of cache timing attacks on this particular hash function. The two sub functions that I believe ...
3k views

### Why don't table lookups run in constant time?

The Wikipedia article on big O notation says that performing a lookup is a constant time operation. So why are lookup tables susceptible to timing attacks?
• 3,655
635 views

### What are the implications of a non “constant time” implementations on trusted systems in a non-network scenario?

Assume a scenario where a symmetric encryption algorithm (for example: AES) wasn't implemented in a way it would safeguard against timing attacks. This symmetric encryption implementation is only used ...
• 17.9k