3 ms·

"Not timeable" isn't entirely accurate. There are still ways to make use of timing information; they are just not this particular textbook example.

• tptacek 16y ago
  Be more specific about the attack you're thinking of?
  • daeken 16y ago
    I may be wrong on this, but if you know the mechanism by which it's hashed, then there should be nothing stopping you from doing the hashing on your side as well, and timing the hash comparison. So if 'foo' hashes to 'abcdef' and 'bar' hashes to 'ab0012', and it takes longer for 'bar' to be checked than 'foo', that tells you something about the hash it's comparing against. Obviously in the real world this is significantly more difficult as it's tough to generate data that hashes to what you want it to, but I don't see why such an attack wouldn't be possible. (Of course, this could be completely different than what the parent was thinking about.)
  • NateLawson 16y ago
    Timing leaks about a password hash can eliminate potential guesses from your dictionary, making a combined online/offline attack marginally more powerful. However, it does not directly reveal the password as it would if they were plaintext.
    • amalcon 16y ago
      This was the one I had in mind.