3 ms·
and that's convertible into a fast attack on the MAC key, even through network delay and jitter? (I wouldn't be surprised, now that you've pointed it out.)
by swolchok 17y ago
and that's convertible into a fast attack on the MAC key, even through network delay and jitter? (I wouldn't be surprised, now that you've pointed it out.)
- tptacek 17y agoThere's a fantastic paper Nate showed me that I need to dig up that established some bounds for timing attacks using statistical filtes. Long story short: you can time low microseconds granularity over the Internet, and you can time nanoseconds over a LAN. Memcmp is just on the threshold of Internet-timeable. And that's memcmp, which screams. But Internet-timeable is irrelevant, because anyone who wants to time your app is just going to get an account at the same hosting provider as you and wind up a GigE hop or two away. Hosting on Slicehost, EC2, Linode, or GAE? That step took 5 minutes and $20. I'd pay $20 to bust up an app I hadn't even heard of, let alone a popular app.
- ephermata 17y agoWhere does Slide or RockYou host?
- ximeng 17y agohttp://codahale.com/a-lesson-in-timing-attacks/ http://codahale.com/a-lesson-in-timing-attacks/ Suggests 20us over internet, 100ns over lan. Are there more complexities to comparing HMACs than are mentioned in this article? I.e. anything else to think about other than not short-circuiting your comparisons when bytes don't match? More discussion (including from someone called Nate, presumably the same person tptacek is referring to) at: http://groups.google.com/group/keyczar-discuss/browse_thread/thread/5571eca0948b2a13 http://groups.google.com/group/keyczar-discuss/browse_thread... And a paper which I can't read without paying: http://www.computer.org/portal/web/csdl/doi/10.1109/MSP.2009.165 http://www.computer.org/portal/web/csdl/doi/10.1109/MSP.2009...