3 ms·
I was a bit disappointed when the focus is not related to cryptography. I.e. a poorly written comparison function compares multiple expressions and the use of
by yegle 5y ago
I was a bit disappointed when the focus is not related to cryptography.
I.e. a poorly written comparison function compares multiple expressions and the use of && short-circuit the logic, result in a timing attack.
Would love to read an article about this topic, i.e. how to write a function whose execution time is constant regardless of the inputs, and thus not leak any side-channel information to the attacker.
- AndreyKarpov 5y agoI agree, it’s a bit of one-sided point of view. It’s only about the code quality. The cryptography analysis is beyond static analysis tools’ capabilities. Static analysis is more high-level study.