3 ms·
Did a quick ctrl + F in the readme to look for how they handle timing attacks in Go. As this is a pure Go implementation, I'm curious - how are these attacks mi
by staticassertion 9y ago
Did a quick ctrl + F in the readme to look for how they handle timing attacks in Go. As this is a pure Go implementation, I'm curious - how are these attacks mitigated, or is that left to consumers of the library?
- inglor 9y agoSome of these attacks are mitigated through the underlying golang crypto package https://golang.org/pkg/crypto/ https://golang.org/pkg/crypto/ - you can see what's constant time and what you have to handle yourself to deal with timing attacks in https://github.com/golang/go/commit/850e55b8c028440f2fe282858b332cb810a06864 https://github.com/golang/go/commit/850e55b8c028440f2fe28285... The library (as a wrapper) doesn't do anything with regards to timing attacks.
- staticassertion 9y agoNothing seems to state that it isn't vulnerable to timing attacks. Everything seems to be. That's unsurprising, since it's all pure go.
- inglor 9y agoI'll clarify - it _is_ vulnerable to timing attacks (except where explicitly mentioned otherwise) - and you should take care of that in your code. It is pretty trivial to defend from timing attacks in a language like go (just race a goroutine with a delay). I agree that it's a good point to bring up though.
- staticassertion 9y agoSeems like something that should be mentioned in the README. Users of this library, by default, are vulnerable. I'm not sold on the 'race a goroutine' solution either, but I'm not much of a Go programmer.
- 0xdeadbeefbabe 9y agoDo you want a situation where the guy who reads the whole README shouldn't use the library?