# Tag Info

### Timing attack and good coding practices

TL;DR at the bottom. The general ideas of timing attacks are the following: Secret data has influence on timing of software Attacker measures timing Attacker computes influence$^{-1}$ to obtain ...
• 9,789

### How can I understand whether my C implementation is constant-time or not (i.e. resistant to timing attacks)

Unfortunately in the absence of documentation from the CPU vendor you can't be 100% sure what algorithms will or will not be constant time. That said, there are certainly rules of thumb that can be ...
• 1,534
Accepted

### Why not use <, > or == in constant time comparison?

C comparison operators (strictly relational < <= > >= and equality == !=) yield 1 if the condition is satisfied and ...
• 5,486
Accepted

### How to confirm my implementation is constant time

How to confirm my implementation is constant time? I'm in scala using bouncy castle from Java. This code is not constant time, for no platform is specified. Computing platforms that run in constant ...
Accepted

### Timing-Safety in JVM-Languages

The theory is: don't try to write timing-safe code in JVM-languages or other essentially-interpreted-but-perhaps-sometime-compiled languages; rather Use timing-safe libraries called from the comfort ...
• 124k

### Timing-Safety in JVM-Languages

Writing constant-time cryptographic code is certainly possible in Java or similar languages (e.g. C#). However you have to do it properly. "Constant-time" here means that the observable time-related ...
• 84.7k
Accepted

### Practical Uses for Timing Attacks on Hash Comparisons (e.g. MD5)?

There is no timing attack possible on MD5 as practically implemented on most platforms. That's because MD5 uses only 32-bit addition, 32-bit bitwise boolean operators, and constant rotations/shifts, ...
• 124k
Accepted

### Why do crypto libs use table lookups when they're vulnerable to timing attacks?

I believe that it is for two reasons: Nontable based implementations of AES are possible, but (assuming you don't have AES-NI or something similar) are significantly slower than table based ...
• 132k

### Timing attack and good coding practices

The following example is difficult to exploit in real life, and impossible over a network, but it is simple enough to understand and extrapolate from. Consider a piece of code on a server that checks ...
• 1,554
Accepted

### Safely sorting secret data

Yes, you can; you can use Batcher's Merge Exchange algorithm, paired with a constant time/access compare-and-swap routine (which reads two elements from locations A and B, and writes the larger ...
• 132k
Accepted

### Is If/else vulnerable to timing side-channel attacks?

Yes, if/else is vulnerable to timing attack. So is selecting the function to call by an array index, as in that other answer. The only next-to-reliable solution for constant-time execution in a high-...
• 124k

### Why don't table lookups run in constant time?

It mostly has to do with the real world influence of memory caches. A cache is a small amount of fast memory; when you read from memory, the contents are placed in this fast memory (possibly along ...
• 132k

### Does this implementation of a function operate in constant time?

Would implementing a function this way run in constant time? This is not an implementation, it is an abstract description of the algorithm. You need an implementation of the function in an actual ...
• 19.2k

### How can I understand whether my C implementation is constant-time or not (i.e. resistant to timing attacks)

Note that this excellent answer is belongs to Squeamish Ossifrage that they stopped contribution! I made a copy and paste then made community. Voting this answer doesn't produce anything to, me. If ...
Accepted

### What are the implications of a non “constant time” implementations on trusted systems in a non-network scenario?

"Constant-time" is about not leaking information through timing-based side-channels. If you assume that there is no side-channel, then, in particular, there is no side-channel attack. It is ...
• 84.7k
Accepted

### Branchless AES Implementation

What makes crypto code vulnerable to timing attacks is data dependent timing variations. Branching according to a round counter, or to the key size, does not create a vulnerability. Most ...
• 124k

### ChaCha20 immune to timing attacks

The obvious way of implementing ChaCha20 involves nothing but additions, fixed rotations, and XORs. All of these are constant time, so the obvious way of implementing ChaCha20 is secure against ...
• 4,643
Accepted

### Is it possible to test implementation for side-channel attacks?

At least for compiled languages it should also be possible to have tools that perform static analysis on machine code, shouldn't it? Indeed, such tools exist. There are companies specialized in ...
• 2,684
Accepted

### Are lookup tables safe when they fit in a cache line?

The typical cache line size of modern x86 machines is 64 bytes. This might not be true for all processors. You should retrieve that from system if you want to know that. Ideally you should split data ...
• 2,910

### Timing-Safety in JVM-Languages

Not in the least. Forget it. This is written from my experience which is with Java, but all JVM languages will have similar insurmountable problems. There are issues with compile time and run time ...
• 13.9k
Accepted

### Does a conditional statement depending on a round number introduce timing attack problems?

Unless the number of rounds is secret, this does indeed not represent a secret-dependent branch. (If the number of rounds is secret, a chap named Auguste would like to have a word with you. Hope you ...
• 45.8k

### Do I need to worry about timing attacks in Base64 encoding/decoding of private keys?

Yes, kind of. The encoding does depend on the individual bits so there could very well be timing differences. Note that the differences would be pretty small; encoding a byte is likely much faster ...
• 85.1k
Accepted

### Adding a number congruent to $0$ to ensure that the mod operation takes a constant number of instruction cycles

As the comment you quote notes: On some platforms, including Intel, the [modulo] operation can take a smaller number of cycles if the input is "small". Is that really true, and what does that mean?...
• 44.4k

### Is it necessary to worry about timing attacks when comparing SHA256 or Argon2 hashes?

Comparing hashes of strings does not fully defeat timing attacks. For example, if we try to find a password by timing attack of ...
• 124k
Accepted

### Synthetic Jitter to Combat Timing Attacks

Yes, and no. Adding random jitter makes things harder, but since you cannot force the device to go faster then the minimum number of instructions it would take to perform the computation without ...
• 7,246

### Constant Time Multiplication for Cryptography in Pure Software without Hardware Multiplier or Barrel Shifter

Constant-time multiplication in software without constant-time multiplier is easy. In C, this working code to compute $x\cdot y$ for 8-bit inputs is typically¹ constant-time: ...
• 124k
Accepted

### Do key-dependent S-boxes make efficient constant-time software implementations almost impossible?

The point in the question makes senses, especially if one restricts to portable software implementations. But: Small or moderately large constant-time RAM tables are reasonable, efficient, and (thus) ...
• 124k

### Why don't table lookups run in constant time?

I just wanted to extend poncho's answer as aspects of this question keep coming up. Generally speaking, you can write constant-time portions of software if you have privileged OS access, but it's not ...
• 4,234

### How can I understand whether my C implementation is constant-time or not (i.e. resistant to timing attacks)

Here's my two cents: A timing-attack uses the time that it takes to execute an algorithm based on different inputs. Take a simpler problem, such as finding if a single character exists in a secret ...
• 171