4 ms·
To be fair, some side channel attacks do allow locking in one character at a time. For example, if a password is evaluated by looking at the string character by
by viceroyalbean 6y ago
To be fair, some side channel attacks do allow locking in one character at a time. For example, if a password is evaluated by looking at the string character by character and breaking once an incorrect character is found you might be able to use the response timing to figure out how many correct characters you have.
- heywire 6y agoI remember this being one of the fun levels in the Stripe Capture-the-Flag contest they ran a few years back. Still got my t-shirt :)
- dividuum 6y agoYep. Level 6 in the first one :-) IIRC their challenge machines were under quite a bit of load and I had difficulties getting the proper solution. If anyone is interested for some reason, here's my writeup including their code and my exploit: https://github.com/dividuum/stripe-ctf https://github.com/dividuum/stripe-ctf