3 ms·
> This one is limited to 5 to 20 us resolution to prevent such attacks. * make such attacks more difficult.
by blattimwind 9y ago
> This one is limited to 5 to 20 us resolution to prevent such attacks.
* make such attacks more difficult.
- Spivak 9y agoImpossible. This attack relies on detecting the timing between a cache hit and miss. If your clock resolution is larger than a cache miss then you can't differentiate the two events and so no information is leaked.
- rocqua 9y agoNot quite. An instruction that takes 1us is much less likely to start and end in a different 20us clock cycle than a 10us instruction. Simple repeated sampling combined with statistics still yields a timing attack. It'll be slower and less deterministic, but it's still a problem.
- Symmetry 9y agoYou can wait for a random period on the scale of the clock then measure and take statistics on the results. It will slow down the attack but not stop it.
- msbarnett 9y agoRight, but all this does is close off one possible avenue for a clever attacker to cobble together an HRT. Given the sheer number of JS APIs that have been thrown into browsers, I think it's pretty naive to imagine that we've closed off the only possible avenue to jury-rig a sufficiently precise measure of time.
- deleted 9y ago[deleted]
- 21 9y agoThe GPS signal in below thermal noise at ambient temperature [1]. Using your logic you would say that then it would be impossible to extract. However, with clever math you can extract a signal which is below the noise floor. Particle physicists are experts at this, extracting tiny signals from huge piles of noisy data. [1] https://sdrgps.blogspot.co.uk/2016/02/find-signal-in-noise.html https://sdrgps.blogspot.co.uk/2016/02/find-signal-in-noise.h...
- kwillets 9y agoI've been pondering how to identify the cached line without a timer. It seems like a classical race condition if multiple reads can be issued at once, eg by ILP. Another thread could easily figure out which load completes first.