4 ms·
A common way to mitigate side-channel attacks is to add random noise to the side channel. In this case the original side channel is timing of network requests.
by ComodoHacker 10y ago
A common way to mitigate side-channel attacks is to add random noise to the side channel. In this case the original side channel is timing of network requests. Thus we can randomize time of network packets arrival, simulating unstable network link and trading speed for security. This can be done in the browser, at OS level client-side or at the server side. It's strange this method isn't mentioned in the paper.
Also I wonder if inherently varying latency of mobile and inhabited Wi-Fi networks can by itself prevent this type of attacks.
Edit: grammar.
- ibotty 10y agoAdding noise is not going to help much. You can just run the test many times and you can use statistics. The only thing helping is deterministic noise: For every security-related thing, you have a deterministic delay. That way you can not apply statistics. Unfortunately that won't work here, at least I don't know how it could.
- madgar 10y agoActually, timing attacks almost always rely on statistical methods in practice due to the inherent noise in relying on coarse timing data. So adding random noise very rarely helps at all other than increasing the amount of data required for the already-prepared statistical methods used in the attack.