4 ms·
If I can observe your (SSL-encrypted) login session, I can time how long the server takes to process your (presumably real) password. What makes you think passw
by JoachimSchipper 15y ago
If I can observe your (SSL-encrypted) login session, I can time how long the server takes to process your (presumably real) password. What makes you think password hashes don't need to worry about this?
- JonnieCache 15y agoWould you really be able to do timing attacks on a server from the client side? I thought you needed a much greater accuracy of measurement, sub-millisecond, than you would be able to achieve with network latency in the mix.
- VBprogrammer 15y agoApparently it can be done. http://www.cs.cmu.edu/~dbrumley/pubs/openssltiming.pdf http://www.cs.cmu.edu/~dbrumley/pubs/openssltiming.pdf
- daeken 15y agoUnless the user is logging in 10000 times in a row, how do you plan to get enough data?
- roel_v 15y agoBut it would only reveal the size of the password, and you'd need to know the work factor, or the other way around, right? Or am I understanding it wrong?
- SamReidHughes 15y agoDoh! To answer your question, probably the fact that it was late, or that I'm an idiot.