Questions tagged [timing-attack]
The side channel attack is based on the fact that the time difference between certain operations executed by the implementation of a cryptographic scheme allow an adversary to get information that he didn't have according to the theoretical specification of the scheme.
101
questions
11
votes
3
answers
878
views
Is If/else vulnerable to timing side-channel attacks?
I have a branching in c++:
if (x & 1)
{
x = function_1(x);
}
else
{
x = function_2(x);
}
If function_1 and ...
- 969
0
votes
1
answer
38
views
AES XEX Mode: Cache-attacks demonstrated?
Assume AES in XEX mode, so we encrypt a plaintext $x$ as $E_K[x \oplus k_1] \oplus k_2$ where $E_K$ is the usual AES Block cipher (assume $x$ is of block size).
Assume the implementation of AES is ...
20
votes
8
answers
5k
views
How can I understand whether my C implementation is constant-time or not (i.e. resistant to timing attacks)
I have a code for polynomial multiplication and it is written in C. I heard that whether a particular instruction is "constant time" can vary by architecture and by processor model and there ...
- 859
1
vote
1
answer
219
views
Timing attacks: Symmetric vs Asymmetric Algorithms
There is a statement that I can't give a reference;
"Since the timing characteristics of symmetric algorithms are not as key dependent as asymmetric algorithms, they are more resistant against ...
- 370
1
vote
0
answers
59
views
How is the Argon2d side channel attack performed?
How should the adversary behave in order to perform a successful side channel attack against Argon2d?
I'm trying to understand the scenario that Argon2i tries to resist against.
- 519
0
votes
1
answer
115
views
Chinese remainder theorem in ECDSA for parameters in secp256k1?
It is known that it is possible to apply the Chinese remainder theorem and attack RSA under precise conditions.
https://tls.mbed.org/public/WSchindler-...
- 3
1
vote
2
answers
89
views
Why is implementation relevant to timing attacks?
Discussions from highly respected sources (details below) emphasize the importance of the implementation of cryptographic software to the effective security provided, with one particular case being ...
- 111
1
vote
1
answer
88
views
How feasible is it to guess the private key of libsodium by taking into account generation time?
So suppose you are doing this locally (so no network noise), and know the exact specifics of your processor too. Is it feasible to figure out the private key (while having access to the public-key) ...
- 647
3
votes
1
answer
141
views
How to ensure that a cryptographic implementation is reasonably sound/robust?
I know from the bottom of my heart how bad the idea of custom-crypto is. I absolutely concur with the recommendation that it should only be done by professionals who specialize in implementing crypto ...
- 75
2
votes
3
answers
355
views
Constant time comparison for arrays of different lengths
I found the following code snippet from the Bouncy Castle C# library, which seems to claim that it's constant time, even when the arrays have different lengths.
...
- 21
4
votes
1
answer
530
views
Constant Time Multiplication for Cryptography in Pure Software without Hardware Multiplier or Barrel Shifter
To prevent various forms of timing side-channel attacks, it's strongly advisable to implementing public-key cryptography in constant time. Or at least, without secret-dependent timing variations. ...
- 91
2
votes
1
answer
66
views
Is is safe to use MtEtM? (MAC-then-Encrypt and Encrypt-than-MAC)
Assuming I am using different secrets/keys for each MAC pass, does running both MtE and EtM creates any vulnerability?
This is what I mean about doing MtEtM:
...
- 121
6
votes
1
answer
296
views
Adapting RSA Timing Attack for Square And Multiply from right-to-left vs left-to-right
I'm trying to reconstruct the fairly well-known RSA timing attack by Kocher. I'm working with simulated timing data, so I have completely noise-free "measurements". My attack is successful ...
- 71
13
votes
1
answer
2k
views
Safely sorting secret data
Suppose you have a secret list of n distinct integers. How would you sort this list in a way that is not vulnerable to timing attacks? I tried looking up "...
- 145
2
votes
1
answer
330
views
Is AES without T-Tables nor S-Box resistant to side-channel?
T-Tables and S-Boxes are prone to side-channel attacks, is an implementation without any lookup tables resistant to side-channel ? In this answer, https://crypto.stackexchange.com/a/63520/80926, the ...
- 343
0
votes
0
answers
110
views
Can someone explain the timing attack on RSA with Montgomery multiplication?
I have read several articles on the temporal attack against Montgomery multiplication to speedup RSA computations. However, I do not quite get the principle.
I understood that there is a additional ...
9
votes
1
answer
2k
views
How to confirm my implementation is constant time
I'm implementing Schnorr signatures following a variant used in Bitcoin Cash (BCH) of this algorithm: GitHub - Schnorr Signatures for secp256k1.
A notable difference is that the BCH schnorr algorithm ...
- 99
2
votes
2
answers
365
views
Mitigating timing attacks with a random sleep
Could you mitigate all timing attacks by putting a sleep(random()) with a naive crypto implementation? Eg if your implementation looks solid, but you're not sure what the next CPU cache vulnerability ...
- 123
0
votes
1
answer
367
views
How to make an AES implementation using lookup tables immune to cache timing attacks?
I recently made a very naive implementation of AES using lookup tables, but it's totally unsafe because of timing attacks. I am not interested in using the processor specific instructions for AES, ...
- 898
1
vote
0
answers
372
views
Question about RSA timing attack and a Chosen Ciphertext Attack on RSA
I am quite new to the RSA and I have a couple of questions that confuse me.
Q1: A Timing attack on RSA can be prevented _____________________________
A. By performing the “square and multiply” ...
- 11
0
votes
0
answers
43
views
exfiltrating salts with timing attacks?
It seems to me that it's theoretically possible to exfiltrate a salt against a hashing algorithm that isn't constant time using specially crafted inputs.
Are there any examples of this being done in ...
- 140
1
vote
0
answers
117
views
Side channel attack: Why building an eviction set is possible?
I'm learning about the side channel attack on the cache. I came to know that most of the attack (EVICT + TIME, PRIME + PROBE, PRIME + ABORT) on the cache is initiated by building an eviction set(a ...
- 21
0
votes
0
answers
51
views
One time code appended to password
Apologies in advance, I'm a beginner and my knowledge of terminology in this field probably reflects that.
I have a question about one-time codes being used with passwords. What inspires me to ask ...
- 101
2
votes
0
answers
61
views
RSA: Blinding versus fixed-time computation
For RSA, what is the standard solution against timing attacks? I know about RSA blinding as one solution.
Another solution is to always compute both the squared value and square-and-multiply values, ...
- 2,214
2
votes
2
answers
1k
views
The attacker model of the Lucky13 attack in TLS
Lucky13 is a timing attack against the MAC in the CBC MAC-then-encrypt ciphersuites. In the attack's page:
The attacks involve detecting small differences in the time at which
TLS error messages ...
- 347
1
vote
1
answer
103
views
obscuring timing attacks in vulnerable libraries
Let's say you're using a library that you know is vulnerable to timing attacks. Short of switching libraries all together it seems to me that putting a sleep in the ...
- 2,703
4
votes
1
answer
227
views
Synthetic Jitter to Combat Timing Attacks
We are working on some tooling. It has a networking kernel.
We would like to think that jitter built into the kernel would help with timing attacks?
Is this true?
- 51
2
votes
0
answers
83
views
Is timing attack practical in a web developer's perspective?
Let's say my server has a non-constant-time compare function for checking if the visitor has a valid session id. The time it takes for the comparator to run would be very insignificant, usually within ...
- 21
1
vote
1
answer
41
views
How does failing to square a value in this version libcrypt++ cause a timing attack vulnerability?
I'm a crypto beginner and reading about blinding, and my fundamental understanding about preventing timing attacks is that you need to sort of process information in a way that will produce similar ...
- 113
3
votes
1
answer
306
views
GCM mode GHASH sensitivity to timing attacks
In GCM mode of authenticated encryption, is it a security concern if the GHASH implementation timing can vary?
If the timing varies according to the AAD/ciphertext data, it looks as though that doesn'...
- 252
2
votes
3
answers
242
views
Hashing items of different Bytes but same length would enable a timing attack?
I am following this paper which comes highly recommended as a secure Registration/Login system over TLS which uses client side computation for the Password Processing Function (PPF). What my main ...
- 21
4
votes
2
answers
1k
views
Constant time implementations of crypto algorithms
To protect against cache attacks (side channel attacks) generally constant time crypto implementations are advised. In some cases DJB released new algorithms (chacha) that are designed with this in ...
- 63
10
votes
1
answer
377
views
AES cache-timing attacks and nonce-based operation modes
As I understand it, AES cache-timing attacks exploit the execution time variations due to cache hits/misses, especially the ones depending on the SBox look-up tables which are key-related.
To mount ...
- 2,684
2
votes
1
answer
195
views
should one worry about timing attacks with signature verification?
To compare two varablies in such a way that timing attacks don't exist it's generally recommended you pad the strings to the same length and then look at each byte, even if an earlier byte was ...
- 2,703
2
votes
3
answers
1k
views
Does this implementation of a function operate in constant time?
Suppose we have a function that takes $n$ parameters, each being one bit in size, and returns a single bit. Internally, this function has a bit string $N \in \{0, 1\}^{2^n}$ and it operates by using ...
- 3,397
7
votes
1
answer
452
views
Does a conditional statement depending on a round number introduce timing attack problems?
In a cryptographic implementation I’m playing with, there’s a round function which includes a conditional if statement.
Stripping the superfluous stuff, the C ...
- 17.4k
0
votes
1
answer
449
views
Cache Timing Attack SHA-3
I’ve been tinkering with SHA-3 for a little bit, and I have some questions regarding the applicability of cache timing attacks on this particular hash function. The two sub functions that I believe ...
- 1
7
votes
3
answers
2k
views
Why don't table lookups run in constant time?
The Wikipedia article on big O notation says that performing a lookup is a constant time operation. So why are lookup tables susceptible to timing attacks?
- 3,397
8
votes
1
answer
549
views
What are the implications of a non “constant time” implementations on trusted systems in a non-network scenario?
Assume a scenario where a symmetric encryption algorithm (for example: AES) wasn't implemented in a way it would safeguard against timing attacks. This symmetric encryption implementation is only used ...
- 17.4k
8
votes
2
answers
1k
views
RSA Timing Attack on "Extra" Montgomery Reduction
In "A practical implementation of the timing attack", the authors take advantage of a timing difference that stems from "extra reductions" that occur when multiplying numbers in the Montgomery form. ...
- 353
8
votes
2
answers
552
views
Timing vulnerability of byte array equality test?
Would the following code to test MAC equality leak timing information ?
...
- 251
4
votes
1
answer
432
views
Dilithium signature scheme and timing attacks – Does the running time actually depend on the secret key?
The paper “CRYSTALS – Dilithium: Digital Signatures from Module Lattices” (by Léo Ducas, Tancrède Lepoint, Vadim Lyubashevsky, Peter Schwabe, Gregor Seiler, and Damien Stehlé) introduces a digital ...
- 4,643
27
votes
5
answers
3k
views
Timing-Safety in JVM-Languages
How is it possible to write timing-safe code in JVM-languages (Java, Scala, Clojure...)?
Is it possible to make libraries like BouncyCastle safe against timing-attacks?
I know that even in C it is ...
- 580
3
votes
1
answer
126
views
Does the timing of cycle-walking pose a threat?
Cycle-walking is a technique for format-preserving encryption that involves repeating an encryption process until the result is inside a desired range.
For example, given an input P, a range R, and ...
- 2,337
1
vote
1
answer
588
views
Implementation of a side channel attack? [closed]
As homework I need to find the password of a crackme in ascii-coded binary. We were also given a specific part of the crackme (in the image below), which we will need to use a side channel attack ...
- 11
9
votes
2
answers
950
views
Are lookup tables safe when they fit in a cache line?
The typical cache line size of modern x86 machines is 64 bytes. Is it safe to use lookup tables with secret data if the table does not exceed the cache line size, and is aligned accordingly?
I was ...
- 2,214
3
votes
1
answer
156
views
Is having AES tables on a distinct physical page enough to avoid cache timing attacks?
Reading about typical cache timing attacks, they seem to be based on intentional eviction of cache lines and timing how long an operation takes. It seems as if those attacks rely upon these tables ...
- 2,214
54
votes
2
answers
12k
views
Timing attack and good coding practices
How would timing attack occur on a particular code but not in another code (because of good coding practice)? Could anyone give an example? I am having trouble figuring out how timing attacks would ...
- 541
2
votes
1
answer
910
views
Is timing analysis attack the same as cache timing attack?
I am working on an essay on timing attacks on DES but then i have seen resources mostly about cache timing attacks. so is timing analysis attack the same as cache timing?
- 21
0
votes
1
answer
316
views
How long would it take on average to perform a timing attack on HMAC over brute forcing a 32bit tag if the hash is good?
How long would it take on average to perform a timing attack on HMAC over brute forcing a 32bit tag if the hash is good?
For example, let's take the hash: 79b7cdc3 to calculate the first byte you ...
- 59