3 ms·
It's nice because it allows a slow and controlled timing attack, but you don't need a page fault to do that, you can simply measure elapsed time with high resol
by Aissen 10y ago
It's nice because it allows a slow and controlled timing attack, but you don't need a page fault to do that, you can simply measure elapsed time with high resolution timers, perf or whatever you have on hand :-)
- JoshTriplett 10y agoTrue, a privileged process having data-dependent execution time for secure data can lead to a variety of side-channel attacks. For more complex cases than password validation, it would help if it were easier to write side-channel-resistant algorithms in something other than assembly. Even a C compiler, let alone something higher-level, can introduce side-channel leaks through optimization.