2 ms·
why can't we solve the constant-time issue by just deciding before the action how long it should take in the worst case, and then just wait for that time before
by bronzeage 7y ago
why can't we solve the constant-time issue by just deciding before the action how long it should take in the worst case, and then just wait for that time before continuing?
- guitarbill 7y agoedit: see other discussion below, https://news.ycombinator.com/item?id=20395393 https://news.ycombinator.com/item?id=20395393 presumably, that would make it very slow, since for every multiplication you'd have to check a timer. you could maybe do it at a higher level, but then how would you know how long a combination of operations would take on that processor? but for a web API, adding random jitter seems like it'd force attackers to use a lot more trials to gain any timing insight.