79
votes
Timing attack and good coding practices
TL;DR at the bottom.
The general ideas of timing attacks are the following:
Secret data has influence on timing of software
Attacker measures timing
Attacker computes influence$^{-1}$ to obtain ...
- 10k
31
votes
How can I understand whether my C implementation is constant-time or not (i.e. resistant to timing attacks)
Unfortunately in the absence of documentation from the CPU vendor you can't be 100% sure what algorithms will or will not be constant time. That said, there are certainly rules of thumb that can be ...
- 1,594
29
votes
Accepted
Why not use `<`, `>` or `==` in constant time comparison?
C comparison operators (strictly relational < <= > >= and equality == !=) yield 1 if the condition is satisfied and ...
- 6,424
24
votes
Accepted
How to confirm my implementation is constant time
How to confirm my implementation is constant time? I'm in scala using bouncy castle from Java.
This code is not constant time, for no platform is specified. Computing platforms that run in constant ...
22
votes
Accepted
Timing-Safety in JVM-Languages
The theory is: don't try to write timing-safe code in JVM-languages or other essentially-interpreted-but-perhaps-sometime-compiled languages; rather
Use timing-safe libraries called from the comfort ...
- 144k
18
votes
Timing-Safety in JVM-Languages
Writing constant-time cryptographic code is certainly possible in Java or similar languages (e.g. C#). However you have to do it properly.
"Constant-time" here means that the observable time-related ...
- 87.7k
15
votes
Timing attack and good coding practices
The following example is difficult to exploit in real life, and impossible over a network, but it is simple enough to understand and extrapolate from.
Consider a piece of code on a server that checks ...
- 1,564
15
votes
How can I understand whether my C implementation is constant-time or not (i.e. resistant to timing attacks)
Note that this excellent answer is belongs to Squeamish Ossifrage that they stopped contribution! I made a copy and paste then made community. Voting this answer doesn't produce anything to, me. If ...
15
votes
Accepted
Is constant-time compare really required for AEAD ciphers?
Let the vulnerable comparison compare byte-by-byte and break out of the loop after the first mismatch. If we neglect noise, this leaks how many bytes (prefix) of the MAC are correct via timing.
Then ...
- 25k
14
votes
Accepted
Safely sorting secret data
Yes, you can; you can use Batcher's Merge Exchange algorithm, paired with a constant time/access compare-and-swap routine (which reads two elements from locations A and B, and writes the larger ...
- 150k
14
votes
Accepted
Is If/else vulnerable to timing side-channel attacks?
Yes, if/else is vulnerable to timing attack. So is selecting the function to call by an array index, as in that other answer.
The only next-to-reliable solution for constant-time execution in a high-...
- 144k
13
votes
Why don't table lookups run in constant time?
It mostly has to do with the real world influence of memory caches.
A cache is a small amount of fast memory; when you read from memory, the contents are placed in this fast memory (possibly along ...
- 150k
12
votes
Does this implementation of a function operate in constant time?
Would implementing a function this way run in constant time?
This is not an implementation, it is an abstract description of the algorithm.
You need an implementation of the function in an actual ...
- 19.8k
11
votes
Accepted
What are the implications of a non “constant time” implementations on trusted systems in a non-network scenario?
"Constant-time" is about not leaking information through timing-based side-channels. If you assume that there is no side-channel, then, in particular, there is no side-channel attack. It is ...
- 87.7k
9
votes
Accepted
Are lookup tables safe when they fit in a cache line?
The typical cache line size of modern x86 machines is 64 bytes.
This might not be true for all processors. You should retrieve that from system if you want to know that. Ideally you should split data ...
- 2,980
9
votes
Timing-Safety in JVM-Languages
Not in the least. Forget it.
This is written from my experience which is with Java, but all JVM languages will have similar insurmountable problems. There are issues with compile time and run time ...
- 15.7k
9
votes
Is it necessary to worry about timing attacks when comparing SHA256 or Argon2 hashes?
Comparing hashes of strings does not fully defeat timing attacks.
For example, if we try to find a password by timing attack of
...
- 144k
9
votes
Accepted
Does a conditional statement depending on a round number introduce timing attack problems?
Unless the number of rounds is secret, this does indeed not represent a secret-dependent branch.
(If the number of rounds is secret, a chap named Auguste would like to have a word with you. Hope you ...
- 49.1k
9
votes
Accepted
Multiplication implemented in c++ with constant time
Is this constant time?
The answre to that would be quite compiler and CPU dependent.
Is there any way to implement this in constant time?
Given a reasonable set of constant time operations (such as ...
- 150k
8
votes
Accepted
Adding a number congruent to $0$ to ensure that the mod operation takes a constant number of instruction cycles
As the comment you quote notes:
On some platforms, including Intel, the [modulo] operation can take a smaller number of cycles if the input is "small".
Is that really true, and what does that mean?...
- 46.4k
8
votes
Accepted
Synthetic Jitter to Combat Timing Attacks
Yes, and no.
Adding random jitter makes things harder, but since you cannot force the device to go faster then the minimum number of instructions it would take to perform the computation without ...
- 7,759
8
votes
Constant Time Multiplication for Cryptography in Pure Software without Hardware Multiplier or Barrel Shifter
Constant-time multiplication in software without constant-time multiplier is easy. In C, this working code to compute $x\cdot y$ for 8-bit inputs is typically¹ constant-time:
...
- 144k
8
votes
Accepted
Resistance against timing attacks of AES candidates
Although I've never implemented any of the AES runner-ups, I thought it would be a fun exercise to come back and look at them in this light. Note I haven't studied any optimized implementations in ...
- 880
7
votes
Why don't table lookups run in constant time?
I just wanted to extend poncho's answer as aspects of this question keep coming up. Generally speaking, you can write constant-time portions of software if you have privileged OS access, but it's not ...
- 4,950
7
votes
How can I understand whether my C implementation is constant-time or not (i.e. resistant to timing attacks)
Here's my two cents:
A timing-attack uses the time that it takes to execute an algorithm based on different inputs.
Take a simpler problem, such as finding if a single character exists in a secret ...
- 171
7
votes
How can I understand whether my C implementation is constant-time or not (i.e. resistant to timing attacks)
What you've heard is correct.
It's an uphill struggle. The compiler and hardware are not designed to help you, and they are deliberately designed to do things that confound what you're trying to do.
...
- 171
6
votes
Is timing analysis attack the same as cache timing attack?
No, cache timing attack is not the same thing as timing attack. The former is a subcategory of the later.
Timing attacks are about inferring information about confidential data (key, plaintext..) ...
- 144k
6
votes
Accepted
Timing vulnerability of byte array equality test?
The comparison c == 0, like the rest of your code, will probably run in constant time.
However, there's no guarantee that it will, and it's just barely conceivable ...
- 46.4k
6
votes
Accepted
Cache Timing Attack SHA-3
SHA-3 is not vulnerable to cache timing attack.
Only implementations could be vulnerable to timing attacks.
Also it is to be noted that cache timing attacks relate secret data and cache lines ...
- 10k
6
votes
Accepted
GCM mode GHASH sensitivity to timing attacks
If the timing varies with public information, then it's not a problem. If the timing varies with secret information like the key in GCM, it is a problem. (While GCM feeds only AAD and ciphertext to ...
- 49.1k
Only top scored, non community-wiki answers of a minimum length are eligible