5 ms·

Why not just append `thread.sleep(random() % 1000)' to your calculations if you are worried about timing attacks?

a_t48 9y ago
Everything else aside (where does one put the sleep?) probably stuff like https://www.sjoerdlangkemper.nl/2016/02/11/cracking-php-rand/ https://www.sjoerdlangkemper.nl/2016/02/11/cracking-php-rand...
- brilee 9y ago
  I'm not sure how that article applies; it discusses the hazards of using a PRNG. I think the actual objection is that it just increases the number of samples required, but doesn't fix the problem.
barrkel 9y ago
Even if your random() is cryptographically strong and not just an LCG, many samples over time will still be able to extract a signal.
mikeash 9y ago
That adds noise to the signal. The signal can still be recovered with more data, so while this helps, it’s not a complete solution.
pornin 9y ago
Measuring the total runtime is only one of many kinds of timing attacks. The most effective timing attacks do not do that; instead, they measure time taken to access some specific memory areas _after_ the execution of the target code, in order to work out which cache lines were loaded by that code (this applies to both data and code caches, btw). These are "timing attacks" since they ultimately come from a measure of elapsed time, but not necessarily the time taken by the target code itself. Also, when a thread is sleeping, the OS will schedule other threads, which opens many additional ways for attackers to notice that sleeping started.
blattimwind 9y ago
Because this doesn't work at all, and would only help with one very specific kind of side channel (e.g. remote timing). I've written about this before on this site: https://news.ycombinator.com/item?id=16069502 https://news.ycombinator.com/item?id=16069502
IncRnd 9y ago
Doing that doesn't work, even for the timing oracle this it's meant to mitigate. There aren't one or two requests being made in timing attacks, and the sleep function only serves to slow down the valid calculations.
Spivak 9y ago
Suppose that x is the true time the operation takes. Then suppose that R is a random variable distributed uniformly on [0, 1000]. If I take a sample I will get values following the distribution x + R. Then we calculate the sample mean of this distribution, X. Keep in mind that I can then set the number of samples to take to achieve my desired accuracy and confidence. Then we look at the mean of the distribution x + R? E(x + R) = E(x) + E(R) = x + E(R) = x + 500 So therefore the true running time is recoverable by taking X - 500.

Everything else aside (where does one put the sleep?) probably stuff like https://www.sjoerdlangkemper.nl/2016/02/11/cracking-php-rand/ https://www.sjoerdlangkemper.nl/2016/02/11/cracking-php-rand...

brilee 9y ago
I'm not sure how that article applies; it discusses the hazards of using a PRNG. I think the actual objection is that it just increases the number of samples required, but doesn't fix the problem.

barrkel 9y ago

Even if your random() is cryptographically strong and not just an LCG, many samples over time will still be able to extract a signal.

mikeash 9y ago

That adds noise to the signal. The signal can still be recovered with more data, so while this helps, it’s not a complete solution.

pornin 9y ago

Measuring the total runtime is only one of many kinds of timing attacks. The most effective timing attacks do not do that; instead, they measure time taken to access some specific memory areas _after_ the execution of the target code, in order to work out which cache lines were loaded by that code (this applies to both data and code caches, btw). These are "timing attacks" since they ultimately come from a measure of elapsed time, but not necessarily the time taken by the target code itself. Also, when a thread is sleeping, the OS will schedule other threads, which opens many additional ways for attackers to notice that sleeping started.

blattimwind 9y ago

Because this doesn't work at all, and would only help with one very specific kind of side channel (e.g. remote timing). I've written about this before on this site: https://news.ycombinator.com/item?id=16069502 https://news.ycombinator.com/item?id=16069502

IncRnd 9y ago

Doing that doesn't work, even for the timing oracle this it's meant to mitigate. There aren't one or two requests being made in timing attacks, and the sleep function only serves to slow down the valid calculations.

Spivak 9y ago

Suppose that x is the true time the operation takes. Then suppose that R is a random variable distributed uniformly on [0, 1000]. If I take a sample I will get values following the distribution x + R. Then we calculate the sample mean of this distribution, X. Keep in mind that I can then set the number of samples to take to achieve my desired accuracy and confidence. Then we look at the mean of the distribution x + R? E(x + R) = E(x) + E(R) = x + E(R) = x + 500 So therefore the true running time is recoverable by taking X - 500.