3 ms·
rand() produces linear distributon, which is uniform. Do I understand properly that rand() + rand() would return normal distribution, so #2, for which you can d
by aljarry 6y ago
rand() produces linear distributon, which is uniform. Do I understand properly that rand() + rand() would return normal distribution, so #2, for which you can determine the non uniformity?
What would be a proper first step to harden API for timing attacks?
- z77dj3kl 6y agorand() + rand() does not give normal. If there is any statistical difference between the timings, it's in theory possible to break. An easy mitigation would be to just drop the card number into a queue and process asynchronously without waiting and returning to the user.
- kevin_thibedeau 6y agoFlood the queue with invalid numbers and timings can still be worked out.
- eru 6y agoAdding any random noise, even perfect randomness, doesn't prevent the attack. It just means the attacker needs more samples.
- mellavora 6y agorand() + rand() does not produce normal, but adding together a few thousand rands does start to approach it. Central limit theorem.