4 ms·

What is the timing sensitivity of this? Is this practical beyond a high-speed, otherwise unused local connection -- on a single device with a single caller (the

by ergo98 16y ago

What is the timing sensitivity of this? Is this practical beyond a high-speed, otherwise unused local connection -- on a single device with a single caller (the demonstration device) and thus no uncontrolled variances that would skew the timing otherwise. Is it applicable outside of scenarios where timing can be controlled down to the sub-microsecond? Adding random sleeps certainly does add variety, however even without adding random sleeps any site on the tubes is going to naturally vary significant just as a result of other requests, tube congestion and routing, etc.

tptacek 16y ago
Fortunately for all of us, over the last couple years this question got answered by academia and then in practical demonstrations by security researchers. Microseconds over the Internet. Nanoseconds over private networks. You can time a simple string compare with single-digit microseconds precision (hence all the broken HMAC implementations). But the timing channel here is much worse; it's a question of an entire crypto algorithm being performed or not performed based on whether the bit you're seeking is 1 or 0. Note that Microsoft's "sleep" suggestion matters not-at-all, since it averages right off. "Adding variety" doesn't mean anything. This is high school statistics. These are practical attacks. They've been demonstrated repeatedly by some of the best cryptographers in the world (Dan Boneh at Stanford, 10 years ago; Paul Kocher at CRI, 15+). They're trivial to exploit (the exploit for HMAC timing is even simpler than the exploit for padding oracles). And yet everyone's first reaction to this problem is, "no way could it work in the real world over the Internet". Because, one assumes they're thinking, if there's one thing computers have trouble with, it's counting.
- ergo98 16y ago
  Revisionism is boring.
  - tptacek 16y ago
    First of all, the video you're talking about wasn't a timing attack. Microseconds over the Internet. Nanoseconds on private networks. Here are some grandstanding security researchers demonstrating this at this year's Black Hat: http://rdist.root.org/2010/07/19/exploiting-remote-timing-attacks/ http://rdist.root.org/2010/07/19/exploiting-remote-timing-at... Note: I don't think they were even using signal processing techniques, which is what the academic results used. Since you don't even know what's being timed here, and the evidence you're collecting to support your argument is two back-to-back reloads of Hacker News, I'm not sure where you get off writing "classic white room scenario". But then, the last thread you commented on, you said "This exploit has remarkably little applicability to the vast majority of ASP.NET applications". Then Bruce told you they used it to get SYSTEM on a remote Sharepoint install.
    - ergo98 16y ago
      You keep modifying your posts to always set it such that you've "pre-rebutted" what I later say, so this thread is futile.
      - tptacek 16y ago
        This isn't a timing attack. It's an attack that, even if you adopt Microsoft's workarounds, can be exploited in a timing variant. Thai didn't demonstrate that variant. I can't make any sense of the rest of your comment.
        deleted 16y ago
        [deleted]

by ergo98 16y ago

tptacek 16y ago

Fortunately for all of us, over the last couple years this question got answered by academia and then in practical demonstrations by security researchers. Microseconds over the Internet. Nanoseconds over private networks. You can time a simple string compare with single-digit microseconds precision (hence all the broken HMAC implementations). But the timing channel here is much worse; it's a question of an entire crypto algorithm being performed or not performed based on whether the bit you're seeking is 1 or 0. Note that Microsoft's "sleep" suggestion matters not-at-all, since it averages right off. "Adding variety" doesn't mean anything. This is high school statistics. These are practical attacks. They've been demonstrated repeatedly by some of the best cryptographers in the world (Dan Boneh at Stanford, 10 years ago; Paul Kocher at CRI, 15+). They're trivial to exploit (the exploit for HMAC timing is even simpler than the exploit for padding oracles). And yet everyone's first reaction to this problem is, "no way could it work in the real world over the Internet". Because, one assumes they're thinking, if there's one thing computers have trouble with, it's counting.

ergo98 16y ago
Revisionism is boring.
- tptacek 16y ago
  First of all, the video you're talking about wasn't a timing attack. Microseconds over the Internet. Nanoseconds on private networks. Here are some grandstanding security researchers demonstrating this at this year's Black Hat: http://rdist.root.org/2010/07/19/exploiting-remote-timing-attacks/ http://rdist.root.org/2010/07/19/exploiting-remote-timing-at... Note: I don't think they were even using signal processing techniques, which is what the academic results used. Since you don't even know what's being timed here, and the evidence you're collecting to support your argument is two back-to-back reloads of Hacker News, I'm not sure where you get off writing "classic white room scenario". But then, the last thread you commented on, you said "This exploit has remarkably little applicability to the vast majority of ASP.NET applications". Then Bruce told you they used it to get SYSTEM on a remote Sharepoint install.
  - ergo98 16y ago
    You keep modifying your posts to always set it such that you've "pre-rebutted" what I later say, so this thread is futile.
    - tptacek 16y ago
      This isn't a timing attack. It's an attack that, even if you adopt Microsoft's workarounds, can be exploited in a timing variant. Thai didn't demonstrate that variant. I can't make any sense of the rest of your comment.
      - deleted 16y ago
        [deleted]