4 ms·
For the timing-based one, you I would've made the server wait a small random amount of time during the process. The xor is more clever, though.
by jimmaswell 13y ago
For the timing-based one, you I would've made the server wait a small random amount of time during the process. The xor is more clever, though.
- Filligree 13y agoNot the way a naive reading of your post suggests, no. If you add a random amount of time, the timing attack still works; it averages out, the same way network jitter does. What you need to do is make every request take the same amount of time; randomness is not helpful here.
- jimmaswell 13y agoI guess I've unintentionally helped prove the article's point, then!