3 ms·
This applies all the way down to machine code. It can be dangerous to branch on secret data or on unauthenticated data, at least if your threat model includes p
by api 2y ago
This applies all the way down to machine code. It can be dangerous to branch on secret data or on unauthenticated data, at least if your threat model includes possible timing attacks.
- woodruffw 2y agoThe corollary to this is that digital signature implantations tend not to be timing hardened, with the assumption that signed-over inputs are not secret. If your scheme assumes that signed-over inputs also need to remain secret, you’re likely misusing your digital signature primitive!