3 ms·

I see a lot of comments about cryptography software, why does this kind of software care about how long the CPU spends on something?

yakubin 4y ago
https://en.wikipedia.org/wiki/Timing_attack https://en.wikipedia.org/wiki/Timing_attack
blueflow 4y ago
Because you can deduce data from the amount of time a piece of code takes: https://en.wikipedia.org/wiki/Timing_attack https://en.wikipedia.org/wiki/Timing_attack
marcyb5st 4y ago
Not an expert by any mean, but I think it's related to timing attacks (https://en.wikipedia.org/wiki/Timing_attack https://en.wikipedia.org/wiki/Timing_attack)
gizmo686 4y ago
The critical component is that the time is "data dependent". Cryptographic keys (and derived materials) are data, so a data dependent execution time could leak information about the keys. As a simple example, consider a naive password check: char* realPass; char* guess; for(int i=0; i<len; i++){ if(realPass[i] != guess[i]) return false } return true. You might think that this function only tells you if the guess was correct or not. But it actually can tell you which character is the first incorrect one. With enough tries and some statistical analysis, this sort of attack had been demonstrated even over the internet.
wongarsu 4y ago
Because if the attacker can observe how long the software takes, that can open you up to timing side channel attacks. The most obvious example is if you compare a user-supplied secret with a stored secret, the naive `for i in 0..min(len(a), len(b)) { if a[i] != b[i] return false } return true` will take longer the more of the first letters you guessed correctly. By averaging lots of tries, even tiny differences can be measured even over the internet. Real crypto code takes some pains to ensure that you can't observe secrets from timing information, but it can only ensure that on the level of assembly instructions. If the CPU messes with timing on the level beyond that, that could open up vulnerabilities.
- ltbarcly3 4y ago
  Very interesting!!
pwg 4y ago
One of the most devastating attacks against cryptography ("crypto") are timing side channel attacks. If the attacker can learn how much time a given crypto routine takes for differing inputs in a system being attacked, they can often pry to locked crypto box wide open and access the protected data inside. https://en.wikipedia.org/wiki/Timing_attack https://en.wikipedia.org/wiki/Timing_attack

yakubin 4y ago

https://en.wikipedia.org/wiki/Timing_attack https://en.wikipedia.org/wiki/Timing_attack

blueflow 4y ago

Because you can deduce data from the amount of time a piece of code takes: https://en.wikipedia.org/wiki/Timing_attack https://en.wikipedia.org/wiki/Timing_attack

marcyb5st 4y ago

Not an expert by any mean, but I think it's related to timing attacks (https://en.wikipedia.org/wiki/Timing_attack https://en.wikipedia.org/wiki/Timing_attack)

gizmo686 4y ago

The critical component is that the time is "data dependent". Cryptographic keys (and derived materials) are data, so a data dependent execution time could leak information about the keys. As a simple example, consider a naive password check: char* realPass; char* guess; for(int i=0; i<len; i++){ if(realPass[i] != guess[i]) return false } return true. You might think that this function only tells you if the guess was correct or not. But it actually can tell you which character is the first incorrect one. With enough tries and some statistical analysis, this sort of attack had been demonstrated even over the internet.

wongarsu 4y ago

Because if the attacker can observe how long the software takes, that can open you up to timing side channel attacks. The most obvious example is if you compare a user-supplied secret with a stored secret, the naive `for i in 0..min(len(a), len(b)) { if a[i] != b[i] return false } return true` will take longer the more of the first letters you guessed correctly. By averaging lots of tries, even tiny differences can be measured even over the internet. Real crypto code takes some pains to ensure that you can't observe secrets from timing information, but it can only ensure that on the level of assembly instructions. If the CPU messes with timing on the level beyond that, that could open up vulnerabilities.

ltbarcly3 4y ago
Very interesting!!

pwg 4y ago

One of the most devastating attacks against cryptography ("crypto") are timing side channel attacks. If the attacker can learn how much time a given crypto routine takes for differing inputs in a system being attacked, they can often pry to locked crypto box wide open and access the protected data inside. https://en.wikipedia.org/wiki/Timing_attack https://en.wikipedia.org/wiki/Timing_attack