4 ms·
Because JS/html provides APIs to perform cryptography(I can't recall whether the cryptography specs are part of ES or HTML/DOM) - if you try to implement consta
by olliej 3y ago
Because JS/html provides APIs to perform cryptography(I can't recall whether the cryptography specs are part of ES or HTML/DOM) - if you try to implement constant time cryptography in JS you will run into a world of hurt due to the entire concept of "fast JS" being dependent on heavy speculation, and lots of exciting variations in timing of even "primitive" operations.
- cryptonector 3y agoNo, the attack would be implemented in JS, not the victim code (though, that too, but that's not what's interesting here).
- olliej 3y agoAh, you’re concerned about person using js to execute the side channel portion of the attack, not the bit creating the side channel :)
- cryptonector 3y agoFYI malicious JS executing in victim users' browsers is a huge concern. All sorts of vulnerabilities can be exploited via JS in this way -- every local side-channel like Spectre/Meltdown, worse things like Row Hammer, etc.