4 ms·
would adding random delays prevent this?
by GoToRO 2y ago
would adding random delays prevent this?
- tptacek 2y agoIt depends on the kinds of attacks you're thinking of. For the stuff Kettle is doing, probably yes. For cryptographic side channels, probably no.
- wiredfool 2y agoOne thing that I’ve done where I previously had a random delay is implement a delay till a constant time from the start of the request. So all of the timing you get out is effectively how well sleep can target a time.
- jack_pp 2y agoor you could benchmark the functions that compare secrets to user input and figure out how much time it's supposed to take, add 0.5s to the average and always add time before responding to get to that target so essentially your response time is constant regardless of input
- tptacek 2y agoImportant to keep in mind here that the timing attacks Kettle is talking about generally do not take the form of "providing secret input to a function with variable timing".
- jack_pp 2y agoHe says this exact same thing in the Defense at the end: > Finally, yes I do recommend using constant-time functions when comparing user input with secret keys. Just ask anyone who says this is an actual threat to provide a proof of concept.
- Filligree 2y agoRandom delays specifically do not, as they average out. Delays until a specific point in time do work, so long as the delay is never negative.
- bostik 2y agoThis particular case would be a fantastic fit for timer wheel.[0] Instead of writing a brittle implementation of "after a fixed time in the future" logic yourself, you queue the outgoing event to occur after N ticks [of granularity X], and let the dedicated data structure engine do the work for you. 0: https://www.snellman.net/blog/archive/2016-07-27-ratas-hierarchical-timer-wheel/ https://www.snellman.net/blog/archive/2016-07-27-ratas-hiera...
- pwagland 2y agoNo, it only makes it take longer to get the underlying secret. Timing attacks are already dealing with "noisy" data, task scheduling et al, so they all boil down to some level of statistical analysis on the response times. Adding noise to that slows you down, but the underlying bias on the timings is still there.
- ozim 2y agoSo in practice it prevents the attack as real world attackers have limited resources and try to find easier targets.
- saagarjha 2y agoThat’s what everyone says until they realize they understated the costs to attempt such an attack.
- ozim 2y agoThat's true if you host wordpress or joomla or something that is widely used that would have timing attack, because then someone will automate it for sure. If you have your custom web app I don't think anyone will bother unless you are bank or something.
- GoblinSlayer 2y agoSo you need to compute this statistics and add just the right delay to even out the bias.
- saagarjha 2y agoAt that point you’ve implemented a constant-time algorithm.
- Alex-Programs 2y agoIt works quite well in practice though. I wonder if you could make an ergonomic library for it. Just add a macro to a function and it'll keep track of how long past executions took to execute and add artificial delays to ensure all subsequent executions are at least that long. If they're longer, extend the minimum time by 2x. Perhaps apply an AIMD algorithm to it? Though there's still room for exploitation there, it'd just take a lot longer to find. Just letting the programmer specify the minimum time might be better in practice.