4 ms·
Noticing that vulnerability was massively clever, IMHO.
by astrofinch 16y ago
Noticing that vulnerability was massively clever, IMHO.
- tptacek 16y agoIt's clever in a number of ways, from the original absurdly clever notion of "side channel attacks" Nate Lawson's old boss Paul Kocher pioneered in the '90s, on through the notion of looking for the same mistake in HMAC implementations (like the one Nate found in Google Keyczar), on through starting a project to go look for timing vulnerabilities in common crypto vulnerabilities. Having said that: now that you know what an HMAC timing attack looks like, it is extremely easy to go find new ones. Go to any source code search site, search for "HMAC", and look how they compare signatures. Chances are, they use the language's standard compare function, and they're likely vulnerable --- as long as you can send candidate messages and get responses.