3 ms·
> terrible defense In what sense? In the sense of not mathematically fixing the problem, or in the sense of leaving it feasible to exploit in reality?
by jamesaguilar 12y ago
> terrible defense
In what sense? In the sense of not mathematically fixing the problem, or in the sense of leaving it feasible to exploit in reality?
- bmm6o 12y agoBoth, unless I don't understand the distinction you're trying to make. The problem is that the law of large numbers is on the attacker's side. If the attacker gets N tries his statistical power goes as sqrt(N), which means that to stay safe the variance in your random delay has to be large enough to cover that. That is, if d is the timing difference between the slow path and the fast path and the attacker gets N tries, the variance in your random delay has to be on the order of d sqrt(N). This is huge even for modest values of N.