3 ms·

Can you do a timing attack against something as fast as a case conversion and a hash function, even if it has a work factor? Normally they're done against datab

Can you do a timing attack against something as fast as a case conversion and a hash function, even if it has a work factor? Normally they're done against database requests aren't they?

carbocation 14y ago
"Remote Timing Attacks are Practical" https://crypto.stanford.edu/~dabo/papers/ssl-timing.pdf https://crypto.stanford.edu/~dabo/papers/ssl-timing.pdf
- JonnieCache 14y ago
  I know you can do timing attacks through the network, it's not even that hard in the simple case. That paper, like most papers on timing attacks, was done on the local network, not the internet. They're relying on absurdly precise measurements of absolutely tiny differences in timing, which would be lost in the jitter and latency of the real internet. As I said, you can certainly do internet timing attacks where you're looking for database access, because this can take many milliseconds, which is a delay which can be detected even on a crappy internet link using a bit of light statistics.
  - carbocation 14y ago
    Right; I guess my thought is that since a hash with a modest work function can also take many milliseconds, this would be meaningful. Not sure in practice, however.
- tptacek 14y ago
  You can't do a timing attack against a password hashed serverside, since you don't control the string being compared enough to make iterated byte-at-a-time changes. Even if I'm misunderstanding, though, this particular remote timing attack is probably not practical in most programming environments; (for instance) straight C memcmp is below the measurement floor, even with signal processing. That is a great paper; also, check out Crosby and Wallach for the modernized, math-ier take; with signal processing, the measurement limits are nanoseconds on a switched LAN (ie, if you could get a box deployed in the same hosting center as Blizzard) and tens of milliseconds over the Internet: http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.65.9811 http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.65.9... ... and Nate Lawson's Black Hat talk which actually goes through the practical issues trying to set up and run these attacks against real systems: http://www.youtube.com/watch?v=A0T8o-Aq3yY http://www.youtube.com/watch?v=A0T8o-Aq3yY
  - JonnieCache 14y ago
    There was a nice talk at 28c3 called "time is on my side" by Sebastian Schinzel, specifically about timing attacks over the net; it is pleasingly practical in its approach. He attacks the popular typo3 CMS. http://www.youtube.com/watch?v=ykNt8pSQFZQ http://www.youtube.com/watch?v=ykNt8pSQFZQ It's very modern, as you describe, with all the fancy maths and all that.
    - tptacek 14y ago
      This is really great. Thanks for sharing it.

Can you do a timing attack against something as fast as a case conversion and a hash function, even if it has a work factor? Normally they're done against database requests aren't they?

carbocation 14y ago

"Remote Timing Attacks are Practical" https://crypto.stanford.edu/~dabo/papers/ssl-timing.pdf https://crypto.stanford.edu/~dabo/papers/ssl-timing.pdf

JonnieCache 14y ago
I know you can do timing attacks through the network, it's not even that hard in the simple case. That paper, like most papers on timing attacks, was done on the local network, not the internet. They're relying on absurdly precise measurements of absolutely tiny differences in timing, which would be lost in the jitter and latency of the real internet. As I said, you can certainly do internet timing attacks where you're looking for database access, because this can take many milliseconds, which is a delay which can be detected even on a crappy internet link using a bit of light statistics.
- carbocation 14y ago
  Right; I guess my thought is that since a hash with a modest work function can also take many milliseconds, this would be meaningful. Not sure in practice, however.
tptacek 14y ago
You can't do a timing attack against a password hashed serverside, since you don't control the string being compared enough to make iterated byte-at-a-time changes. Even if I'm misunderstanding, though, this particular remote timing attack is probably not practical in most programming environments; (for instance) straight C memcmp is below the measurement floor, even with signal processing. That is a great paper; also, check out Crosby and Wallach for the modernized, math-ier take; with signal processing, the measurement limits are nanoseconds on a switched LAN (ie, if you could get a box deployed in the same hosting center as Blizzard) and tens of milliseconds over the Internet: http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.65.9811 http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.65.9... ... and Nate Lawson's Black Hat talk which actually goes through the practical issues trying to set up and run these attacks against real systems: http://www.youtube.com/watch?v=A0T8o-Aq3yY http://www.youtube.com/watch?v=A0T8o-Aq3yY
- JonnieCache 14y ago
  There was a nice talk at 28c3 called "time is on my side" by Sebastian Schinzel, specifically about timing attacks over the net; it is pleasingly practical in its approach. He attacks the popular typo3 CMS. http://www.youtube.com/watch?v=ykNt8pSQFZQ http://www.youtube.com/watch?v=ykNt8pSQFZQ It's very modern, as you describe, with all the fancy maths and all that.
  - tptacek 14y ago
    This is really great. Thanks for sharing it.