79 votes

Timing attack and good coding practices

TL;DR at the bottom. The general ideas of timing attacks are the following: Secret data has influence on timing of software Attacker measures timing Attacker computes influence$^{-1}$ to obtain ...
user avatar
  • 9,789
30 votes

How can I understand whether my C implementation is constant-time or not (i.e. resistant to timing attacks)

Unfortunately in the absence of documentation from the CPU vendor you can't be 100% sure what algorithms will or will not be constant time. That said, there are certainly rules of thumb that can be ...
user avatar
  • 1,534
28 votes
Accepted

Why not use `<`, `>` or `==` in constant time comparison?

C comparison operators (strictly relational < <= > >= and equality == !=) yield 1 if the condition is satisfied and ...
user avatar
25 votes
Accepted

How to confirm my implementation is constant time

How to confirm my implementation is constant time? I'm in scala using bouncy castle from Java. This code is not constant time, for no platform is specified. Computing platforms that run in constant ...
22 votes
Accepted

Timing-Safety in JVM-Languages

The theory is: don't try to write timing-safe code in JVM-languages or other essentially-interpreted-but-perhaps-sometime-compiled languages; rather Use timing-safe libraries called from the comfort ...
user avatar
  • 124k
18 votes

Timing-Safety in JVM-Languages

Writing constant-time cryptographic code is certainly possible in Java or similar languages (e.g. C#). However you have to do it properly. "Constant-time" here means that the observable time-related ...
user avatar
16 votes
Accepted

Practical Uses for Timing Attacks on Hash Comparisons (e.g. MD5)?

There is no timing attack possible on MD5 as practically implemented on most platforms. That's because MD5 uses only 32-bit addition, 32-bit bitwise boolean operators, and constant rotations/shifts, ...
user avatar
  • 124k
16 votes
Accepted

Why do crypto libs use table lookups when they're vulnerable to timing attacks?

I believe that it is for two reasons: Nontable based implementations of AES are possible, but (assuming you don't have AES-NI or something similar) are significantly slower than table based ...
user avatar
  • 132k
15 votes

Timing attack and good coding practices

The following example is difficult to exploit in real life, and impossible over a network, but it is simple enough to understand and extrapolate from. Consider a piece of code on a server that checks ...
user avatar
  • 1,554
14 votes
Accepted

Safely sorting secret data

Yes, you can; you can use Batcher's Merge Exchange algorithm, paired with a constant time/access compare-and-swap routine (which reads two elements from locations A and B, and writes the larger ...
user avatar
  • 132k
14 votes
Accepted

Is If/else vulnerable to timing side-channel attacks?

Yes, if/else is vulnerable to timing attack. So is selecting the function to call by an array index, as in that other answer. The only next-to-reliable solution for constant-time execution in a high-...
user avatar
  • 124k
13 votes

Why don't table lookups run in constant time?

It mostly has to do with the real world influence of memory caches. A cache is a small amount of fast memory; when you read from memory, the contents are placed in this fast memory (possibly along ...
user avatar
  • 132k
12 votes

Does this implementation of a function operate in constant time?

Would implementing a function this way run in constant time? This is not an implementation, it is an abstract description of the algorithm. You need an implementation of the function in an actual ...
user avatar
  • 19.2k
12 votes

How can I understand whether my C implementation is constant-time or not (i.e. resistant to timing attacks)

Note that this excellent answer is belongs to Squeamish Ossifrage that they stopped contribution! I made a copy and paste then made community. Voting this answer doesn't produce anything to, me. If ...
11 votes
Accepted

What are the implications of a non “constant time” implementations on trusted systems in a non-network scenario?

"Constant-time" is about not leaking information through timing-based side-channels. If you assume that there is no side-channel, then, in particular, there is no side-channel attack. It is ...
user avatar
9 votes
Accepted

Branchless AES Implementation

What makes crypto code vulnerable to timing attacks is data dependent timing variations. Branching according to a round counter, or to the key size, does not create a vulnerability. Most ...
user avatar
  • 124k
9 votes

ChaCha20 immune to timing attacks

The obvious way of implementing ChaCha20 involves nothing but additions, fixed rotations, and XORs. All of these are constant time, so the obvious way of implementing ChaCha20 is secure against ...
user avatar
  • 4,643
9 votes
Accepted

Is it possible to test implementation for side-channel attacks?

At least for compiled languages it should also be possible to have tools that perform static analysis on machine code, shouldn't it? Indeed, such tools exist. There are companies specialized in ...
user avatar
  • 2,684
9 votes
Accepted

Are lookup tables safe when they fit in a cache line?

The typical cache line size of modern x86 machines is 64 bytes. This might not be true for all processors. You should retrieve that from system if you want to know that. Ideally you should split data ...
user avatar
  • 2,910
9 votes

Timing-Safety in JVM-Languages

Not in the least. Forget it. This is written from my experience which is with Java, but all JVM languages will have similar insurmountable problems. There are issues with compile time and run time ...
user avatar
  • 13.9k
9 votes
Accepted

Does a conditional statement depending on a round number introduce timing attack problems?

Unless the number of rounds is secret, this does indeed not represent a secret-dependent branch. (If the number of rounds is secret, a chap named Auguste would like to have a word with you. Hope you ...
user avatar
8 votes

Do I need to worry about timing attacks in Base64 encoding/decoding of private keys?

Yes, kind of. The encoding does depend on the individual bits so there could very well be timing differences. Note that the differences would be pretty small; encoding a byte is likely much faster ...
user avatar
  • 85.1k
8 votes
Accepted

Adding a number congruent to $0$ to ensure that the mod operation takes a constant number of instruction cycles

As the comment you quote notes: On some platforms, including Intel, the [modulo] operation can take a smaller number of cycles if the input is "small". Is that really true, and what does that mean?...
user avatar
8 votes

Is it necessary to worry about timing attacks when comparing SHA256 or Argon2 hashes?

Comparing hashes of strings does not fully defeat timing attacks. For example, if we try to find a password by timing attack of ...
user avatar
  • 124k
8 votes
Accepted

Synthetic Jitter to Combat Timing Attacks

Yes, and no. Adding random jitter makes things harder, but since you cannot force the device to go faster then the minimum number of instructions it would take to perform the computation without ...
user avatar
  • 7,246
8 votes

Constant Time Multiplication for Cryptography in Pure Software without Hardware Multiplier or Barrel Shifter

Constant-time multiplication in software without constant-time multiplier is easy. In C, this working code to compute $x\cdot y$ for 8-bit inputs is typically¹ constant-time: ...
user avatar
  • 124k
7 votes
Accepted

Do key-dependent S-boxes make efficient constant-time software implementations almost impossible?

The point in the question makes senses, especially if one restricts to portable software implementations. But: Small or moderately large constant-time RAM tables are reasonable, efficient, and (thus) ...
user avatar
  • 124k
7 votes

Why don't table lookups run in constant time?

I just wanted to extend poncho's answer as aspects of this question keep coming up. Generally speaking, you can write constant-time portions of software if you have privileged OS access, but it's not ...
user avatar
  • 4,234
7 votes

How can I understand whether my C implementation is constant-time or not (i.e. resistant to timing attacks)

Here's my two cents: A timing-attack uses the time that it takes to execute an algorithm based on different inputs. Take a simpler problem, such as finding if a single character exists in a secret ...
user avatar
  • 171
6 votes
Accepted

Do asymmetric signatures require constant-time verification?

Towards the security of the signature scheme, no precaution against timing attack is necessary when verifying an asymmetric signature. That's because there is no secret involved, thus no information ...
user avatar
  • 124k

Only top scored, non community-wiki answers of a minimum length are eligible