2 ms·
Nothing seems to state that it isn't vulnerable to timing attacks. Everything seems to be. That's unsurprising, since it's all pure go.
by staticassertion 9y ago
Nothing seems to state that it isn't vulnerable to timing attacks. Everything seems to be. That's unsurprising, since it's all pure go.
- inglor 9y agoI'll clarify - it _is_ vulnerable to timing attacks (except where explicitly mentioned otherwise) - and you should take care of that in your code. It is pretty trivial to defend from timing attacks in a language like go (just race a goroutine with a delay). I agree that it's a good point to bring up though.
- staticassertion 9y agoSeems like something that should be mentioned in the README. Users of this library, by default, are vulnerable. I'm not sold on the 'race a goroutine' solution either, but I'm not much of a Go programmer.
- 0xdeadbeefbabe 9y agoDo you want a situation where the guy who reads the whole README shouldn't use the library?