3 ms·
If this is a timing sidechannel, why is it considered s protocol vulnerability and not an implementation vulnerability? Could it be mitigated by using a time-co
by bzngcqt 6y ago
If this is a timing sidechannel, why is it considered s protocol vulnerability and not an implementation vulnerability? Could it be mitigated by using a time-constant implementation of the KDF?
- baby 6y agoBecause the specification does not mandate a constant time operation.
- dependenttypes 6y agoYou are not mandated a constant-time aes implementation either.
- baby 6y agonobody cares about an AES constant time implementation, but any specification about MACs and signing algorithms will specifically mention that you need to have constant-time operations