Newest 'timing-attack' Questions

6

votes

1answer

52 views

Adapting RSA Timing Attack for Square And Multiply from right-to-left vs left-to-right

I'm trying to reconstruct the fairly well-known RSA timing attack by Kocher. I'm working with simulated timing data, so I have completely noise-free "measurements". My attack is successful ...

rsa timing-attack

asked Aug 23 at 23:31

Richard

712 bronze badges

13

votes

1answer

2k views

Safely sorting secret data

Suppose you have a secret list of n distinct integers. How would you sort this list in a way that is not vulnerable to timing attacks? I tried looking up "...

side-channel-attack timing-attack

asked Jul 9 at 21:08

Kai Arakawa

1459 bronze badges

2

votes

1answer

106 views

Is AES without T-Tables nor S-Box resistant to side-channel?

T-Tables and S-Boxes are prone to side-channel attacks, is an implementation without any lookup tables resistant to side-channel ? In this answer, https://crypto.stackexchange.com/a/63520/80926, the ...

aes cryptanalysis side-channel-attack timing-attack

asked Jun 26 at 1:36

moutonlapin28

1937 bronze badges

0

votes

0answers

60 views

Can someone explain the timing attack on RSA with Montgomery multiplication?

I have read several articles on the temporal attack against Montgomery multiplication to speedup RSA computations. However, I do not quite get the principle. I understood that there is a additional ...

rsa cryptanalysis attack timing-attack montgomery-multiplication

asked May 10 at 3:34

Black cryptographer

112 bronze badges

8

votes

1answer

2k views

How to confirm my implementation is constant time

I'm implementing Schnorr signatures following a variant used in Bitcoin Cash (BCH) of this algorithm: GitHub - Schnorr Signatures for secp256k1. A notable difference is that the BCH schnorr algorithm ...

side-channel-attack timing-attack schnorr-signature

asked May 6 at 3:54

sken

895 bronze badges

2

votes

2answers

119 views

Mitigating timing attacks with a random sleep

Could you mitigate all timing attacks by putting a sleep(random()) with a naive crypto implementation? Eg if your implementation looks solid, but you're not sure what the next CPU cache vulnerability ...

timing-attack

asked Feb 13 at 0:32

Chris

1235 bronze badges

0

votes

1answer

128 views

How to make an AES implementation using lookup tables immune to cache timing attacks?

I recently made a very naive implementation of AES using lookup tables, but it's totally unsafe because of timing attacks. I am not interested in using the processor specific instructions for AES, ...

aes timing-attack

asked Jan 12 at 14:10

Vivekanand V

6621 silver badge10 bronze badges

1

vote

0answers

170 views

Question about RSA timing attack and a Chosen Ciphertext Attack on RSA

I am quite new to the RSA and I have a couple of questions that confuse me. Q1: A Timing attack on RSA can be prevented _____________________________ A. By performing the “square and multiply” ...

encryption rsa cryptanalysis timing-attack

asked Nov 11 '19 at 19:54

Godfrey

112 bronze badges

0

votes

0answers

32 views

exfiltrating salts with timing attacks?

It seems to me that it's theoretically possible to exfiltrate a salt against a hashing algorithm that isn't constant time using specially crafted inputs. Are there any examples of this being done in ...

password-hashing timing-attack

asked Nov 11 '19 at 6:51

Daniel Hill

1413 bronze badges

1

vote

0answers

62 views

Side channel attack: Why building an eviction set is possible?

I'm learning about the side channel attack on the cache. I came to know that most of the attack (EVICT + TIME, PRIME + PROBE, PRIME + ABORT) on the cache is initiated by building an eviction set(a ...

side-channel-attack timing-attack cpu

asked Jun 13 '19 at 2:15

randomUser

211 bronze badge

0

votes

0answers

35 views

One time code appended to password

Apologies in advance, I'm a beginner and my knowledge of terminology in this field probably reflects that. I have a question about one-time codes being used with passwords. What inspires me to ask ...

timing-attack one-time-password

asked Mar 29 '19 at 18:31

MadisonCooper

101

2

votes

0answers

44 views

RSA: Blinding versus fixed-time computation

For RSA, what is the standard solution against timing attacks? I know about RSA blinding as one solution. Another solution is to always compute both the squared value and square-and-multiply values, ...

rsa side-channel-attack timing-attack

asked Mar 20 '19 at 22:02

Myria

1,6956 silver badges15 bronze badges

2

votes

2answers

939 views

The attacker model of the Lucky13 attack in TLS

Lucky13 is a timing attack against the MAC in the CBC MAC-then-encrypt ciphersuites. In the attack's page: The attacks involve detecting small differences in the time at which TLS error messages ...

tls cbc openssl cbc-mac timing-attack

asked Oct 27 '18 at 21:22

user9371654

2973 silver badges8 bronze badges

1

vote

1answer

97 views

obscuring timing attacks in vulnerable libraries

Let's say you're using a library that you know is vulnerable to timing attacks. Short of switching libraries all together it seems to me that putting a sleep in the ...

timing-attack

asked Sep 26 '18 at 19:37

neubert

2,53919 silver badges37 bronze badges

4

votes

1answer

181 views

Synthetic Jitter to Combat Timing Attacks

We are working on some tooling. It has a networking kernel. We would like to think that jitter built into the kernel would help with timing attacks? Is this true?

randomness timing-attack

asked Aug 12 '18 at 17:44

cryptoJim

512 bronze badges

2

votes

0answers

76 views

Is timing attack practical in a web developer's perspective?

Let's say my server has a non-constant-time compare function for checking if the visitor has a valid session id. The time it takes for the comparator to run would be very insignificant, usually within ...

authentication timing-attack

asked Aug 11 '18 at 10:03

longcc

211 bronze badge

1

vote

1answer

37 views

How does failing to square a value in this version libcrypt++ cause a timing attack vulnerability?

I'm a crypto beginner and reading about blinding, and my fundamental understanding about preventing timing attacks is that you need to sort of process information in a way that will produce similar ...

timing-attack

asked Jul 30 '18 at 13:30

john doe

1133 bronze badges

3

votes

1answer

251 views

GCM mode GHASH sensitivity to timing attacks

In GCM mode of authenticated encryption, is it a security concern if the GHASH implementation timing can vary? If the timing varies according to the AAD/ciphertext data, it looks as though that doesn'...

gcm timing-attack

asked May 29 '18 at 2:28

Craig McQueen

2522 silver badges8 bronze badges

2

votes

3answers

224 views

Hashing items of different Bytes but same length would enable a timing attack?

I am following this paper which comes highly recommended as a secure Registration/Login system over TLS which uses client side computation for the Password Processing Function (PPF). What my main ...

hash password-hashing timing-attack

asked Mar 26 '18 at 2:57

Lolu Gewub

212 bronze badges

4

votes

2answers

789 views

Constant time implementations of crypto algorithms

To protect against cache attacks (side channel attacks) generally constant time crypto implementations are advised. In some cases DJB released new algorithms (chacha) that are designed with this in ...

side-channel-attack cryptographic-hardware timing-attack

asked Mar 12 '18 at 1:56

stflow

633 bronze badges

10

votes

1answer

298 views

AES cache-timing attacks and nonce-based operation modes

As I understand it, AES cache-timing attacks exploit the execution time variations due to cache hits/misses, especially the ones depending on the SBox look-up tables which are key-related. To mount ...

aes gcm timing-attack ccm

asked Feb 23 '18 at 10:38

Raoul722

2,5072 gold badges13 silver badges31 bronze badges

2

votes

1answer

158 views

should one worry about timing attacks with signature verification?

To compare two varablies in such a way that timing attacks don't exist it's generally recommended you pad the strings to the same length and then look at each byte, even if an earlier byte was ...

public-key signature dsa timing-attack

asked Feb 10 '18 at 22:09

neubert

2,53919 silver badges37 bronze badges

2

votes

3answers

1k views

Does this implementation of a function operate in constant time?

Suppose we have a function that takes $n$ parameters, each being one bit in size, and returns a single bit. Internally, this function has a bit string $N \in \{0, 1\}^{2^n}$ and it operates by using ...

timing-attack

asked Jan 18 '18 at 22:37

Melab

3,1391 gold badge16 silver badges31 bronze badges

7

votes

1answer

426 views

Does a conditional statement depending on a round number introduce timing attack problems?

In a cryptographic implementation I’m playing with, there’s a round function which includes a conditional if statement. Stripping the superfluous stuff, the C ...

algorithm-design implementation timing-attack

asked Dec 16 '17 at 18:00

e-sushi

16.8k9 gold badges69 silver badges200 bronze badges

0

votes

1answer

358 views

Cache Timing Attack SHA-3

I’ve been tinkering with SHA-3 for a little bit, and I have some questions regarding the applicability of cache timing attacks on this particular hash function. The two sub functions that I believe ...

implementation sha-3 timing-attack keccak

asked Dec 15 '17 at 0:04

Q-Club

1

6

votes

3answers

1k views

Why don't table lookups run in constant time?

The Wikipedia article on big O notation says that performing a lookup is a constant time operation. So why are lookup tables susceptible to timing attacks?

complexity s-boxes side-channel-attack timing-attack

asked Nov 29 '17 at 17:00

Melab

3,1391 gold badge16 silver badges31 bronze badges

8

votes

1answer

515 views

What are the implications of a non “constant time” implementations on trusted systems in a non-network scenario?

Assume a scenario where a symmetric encryption algorithm (for example: AES) wasn't implemented in a way it would safeguard against timing attacks. This symmetric encryption implementation is only used ...

aes cryptanalysis attack timing-attack

asked Oct 18 '17 at 12:20

e-sushi

16.8k9 gold badges69 silver badges200 bronze badges

7

votes

2answers

902 views

RSA Timing Attack on “Extra” Montgomery Reduction

In "A practical implementation of the timing attack", the authors take advantage of a timing difference that stems from "extra reductions" that occur when multiplying numbers in the Montgomery form. ...

rsa side-channel-attack timing-attack montgomery-multiplication

asked Oct 13 '17 at 3:13

kkl

3431 silver badge7 bronze badges

8

votes

2answers

420 views

Timing vulnerability of byte array equality test?

Would the following code to test MAC equality leak timing information ? ...

implementation timing-attack

asked Sep 10 '17 at 10:52

chmike

2371 silver badge6 bronze badges

4

votes

1answer

362 views

Dilithium signature scheme and timing attacks – Does the running time actually depend on the secret key?

The paper “CRYSTALS – Dilithium: Digital Signatures from Module Lattices” (by Léo Ducas, Tancrède Lepoint, Vadim Lyubashevsky, Peter Schwabe, Gregor Seiler, and Damien Stehlé) introduces a digital ...

post-quantum-cryptography lattice-crypto side-channel-attack timing-attack

asked Jul 30 '17 at 4:26

Demi

4,4111 gold badge13 silver badges29 bronze badges

26

votes

5answers

3k views

Timing-Safety in JVM-Languages

How is it possible to write timing-safe code in JVM-languages (Java, Scala, Clojure...)? Is it possible to make libraries like BouncyCastle safe against timing-attacks? I know that even in C it is ...

implementation side-channel-attack timing-attack

asked Jul 5 '17 at 14:11

K. Biermann

5605 silver badges11 bronze badges

3

votes

1answer

108 views

Does the timing of cycle-walking pose a threat?

Cycle-walking is a technique for format-preserving encryption that involves repeating an encryption process until the result is inside a desired range. For example, given an input P, a range R, and ...

cryptanalysis timing-attack format-preserving

asked Jul 2 '17 at 1:02

Daffy

2,21710 silver badges26 bronze badges

1

vote

1answer

527 views

Implementation of a side channel attack? [closed]

As homework I need to find the password of a crackme in ascii-coded binary. We were also given a specific part of the crackme (in the image below), which we will need to use a side channel attack ...

side-channel-attack timing-attack

asked May 16 '17 at 11:26

naspar

111 bronze badge

9

votes

2answers

839 views

Are lookup tables safe when they fit in a cache line?

The typical cache line size of modern x86 machines is 64 bytes. Is it safe to use lookup tables with secret data if the table does not exceed the cache line size, and is aligned accordingly? I was ...

implementation gcm timing-attack

asked Jan 24 '17 at 0:09

Myria

1,6956 silver badges15 bronze badges

3

votes

1answer

133 views

Is having AES tables on a distinct physical page enough to avoid cache timing attacks?

Reading about typical cache timing attacks, they seem to be based on intentional eviction of cache lines and timing how long an operation takes. It seems as if those attacks rely upon these tables ...

aes side-channel-attack timing-attack

asked Jan 5 '17 at 23:46

Myria

1,6956 silver badges15 bronze badges

53

votes

2answers

11k views

Timing attack and good coding practices

How would timing attack occur on a particular code but not in another code (because of good coding practice)? Could anyone give an example? I am having trouble figuring out how timing attacks would ...

timing-attack

asked Nov 21 '16 at 6:52

asdfasd

5311 gold badge5 silver badges3 bronze badges

2

votes

1answer

832 views

Is timing analysis attack the same as cache timing attack?

I am working on an essay on timing attacks on DES but then i have seen resources mostly about cache timing attacks. so is timing analysis attack the same as cache timing?

des timing-attack

asked Nov 20 '16 at 16:38

johndoe12

211 bronze badge

0

votes

1answer

254 views

How long would it take on average to perform a timing attack on HMAC over brute forcing a 32bit tag if the hash is good?

How long would it take on average to perform a timing attack on HMAC over brute forcing a 32bit tag if the hash is good? For example, let's take the hash: 79b7cdc3 to calculate the first byte you ...

cryptanalysis hmac brute-force-attack attack timing-attack

asked Nov 19 '16 at 11:43

NoDirection

595 bronze badges

3

votes

1answer

2k views

Side Channel Attacks

How to make cipher resist against Side channel Attacks. Specially Timing Attack, Cachet Timing Attach, Simple/ Differential Power Analysis. Uptil now it seems all Standard Algorithms like AES, ...

aes side-channel-attack timing-attack camellia

asked Nov 11 '16 at 6:32

abraza

1,80710 silver badges23 bronze badges

1

vote

0answers

169 views

Kocher Timing Attack - Error Correction

In class, we learned the Kocher Timing Attacke on modular exponentiation. For determining whether the (e.g., LSB) is 0 or 1, we specified two values: $T_1 = T_M - (TMult(1, y) + (\omega -1)ExpTMult)$ ...

timing-attack

asked Oct 4 '16 at 12:24

Christine

3031 silver badge4 bronze badges

4

votes

1answer

922 views

Is it necessary to worry about timing attacks when comparing SHA256 or Argon2 hashes?

It seems to me that a timing-safe way to compare any two strings is to take a secure hash of both of them and then compare the result. I would expect that the initial hashing would render any timing ...

sha-256 timing-attack argon2

asked Oct 4 '16 at 2:17

Demi

4,4111 gold badge13 silver badges29 bronze badges

3

votes

1answer

197 views

Working Precision and Time-constant Arithmetic with ECC?

I am interested in Elliptic Curve Cryptography and found algorithms for constant-time multiplication. Within these algorithms arithmetic operations must be performed (like addition and multiplication)....

elliptic-curves timing-attack

asked Aug 30 '16 at 20:31

user3637203

1533 bronze badges

5

votes

3answers

129 views

Adding a number congruent to $0$ to ensure that the mod operation takes a constant number of instruction cycles

I've been looking at the s2n implementation of HMAC, and in the `update' function (line 175), it says ...

hmac implementation modular-arithmetic timing-attack

asked Aug 30 '16 at 10:42

man_in_green_shirt

1654 bronze badges

12

votes

1answer

3k views

Why not use `<`, `>` or `==` in constant time comparison?

I am comparing secret data stored in arrays a and b to see which holds a greater value. My current (pseudo)code looks like this:...

side-channel-attack timing-attack

asked Aug 17 '16 at 18:58

Sebastian

3372 silver badges6 bronze badges

3

votes

0answers

106 views

Attacking Scrypt Under Access Pattern Leakage

Could cache-timing channels (such as exist for certain block ciphers) somehow be made use of in order to extract memory-access pattern information if both the attacker and user are NOT in a shared ...

scrypt memory-hard timing-attack

asked Jun 24 '16 at 14:26

McJohnson

1231 silver badge3 bronze badges

12

votes

1answer

1k views

Is it possible to test implementation for side-channel attacks?

When it comes to implementing cryptographic algorithms, there seems to be a big focus on the difficulty of doing so without introducing the potential for side channel attacks and the knowledge ...

implementation side-channel-attack timing-attack

asked Jun 23 '16 at 1:52

DasIch

2231 silver badge6 bronze badges

5

votes

1answer

308 views

Do key-dependent S-boxes make efficient constant-time software implementations almost impossible?

It seems to me that algorithms like Blowfish and Twofish with key-dependent S-boxes are almost impossible to implement without table lookups, and thus are almost impossible to implement in software ...

s-boxes timing-attack

asked May 24 '16 at 2:22

Demi

4,4111 gold badge13 silver badges29 bronze badges

11

votes

2answers

565 views

Do I need to worry about timing attacks in Base64 encoding/decoding of private keys?

Do I need to worry about timing attacks in Base64 encoding/decoding of private keys? This is a common operation (ex. PEM keys) and is variable time in typical implementations.

keys timing-attack encoding

asked May 23 '16 at 6:15

Demi

4,4111 gold badge13 silver badges29 bronze badges

1

vote

1answer

193 views

Single-scalar multiplication with sign bit

I want to know if there's an "easy" timing-free way to compute the sign of $y$-coordinate of $r G$, for a secret scalar $r$ and $G$ the generator of an elliptic curve. We have several choices for ...

elliptic-curves signature ed25519 timing-attack schnorr-signature

asked May 17 '16 at 19:05

Nicholas Wilson

1134 bronze badges

2

votes

2answers

223 views

is accessing elements of an array in secret order vulnerable to timing attack?

Suppose there is an array containing bytes 0...255. Suppose this array is shuffled using a key for random data. Since this is indexing the elements of a table using secret data, is it vulnerable to ...

timing-attack

asked Apr 22 '16 at 5:29

Ella Rose

18.5k5 gold badges46 silver badges92 bronze badges

Questions tagged [timing-attack]

Related Tags