3 ms·
I was wondering about that timing attack. Is that really possible? How many requests would you have to make until you can get reliable statistics over the timi
by ma2rten 14y ago
I was wondering about that timing attack. Is that really possible? How many requests would you have to make until you can get reliable statistics over the timing of a string comparison, when you have network delays, other requests and all kinds of stuff that influence timing?
- tptacek 14y agoIt's very difficult, but possible. It's a plausible enough threat, especially if you're cloud hosted now or ever might be, that you should take steps to avoid it. Jitter and confounding are problems that can be addressed simply by repeated measurements. The rule-of-thumb from Crosby & Wallach's paper on remote timing attacks is, assume tens-to-hundreds of nanoseconds precision if you can colocate the attacker at the same provider, and tens of microseconds if you have to do it over the Internet.
- ma2rten 14y agoThanks for your reply. I was totally oblivious to this type of timing attack before I read the article.