4 ms·
Yes, okay, however my point was we don't actually need constant-time operation if the timing is uniformly random. Clearly that doesn't mean we introduce a rando
by bascule 12y ago
Yes, okay, however my point was we don't actually need constant-time operation if the timing is uniformly random. Clearly that doesn't mean we introduce a random sleep, but it means we carry out computations in a way that timings aren't data-dependent and an attacker can't separate signal from noise.
- sdevlin 12y agoI guess I'm still unclear how that would work in the context of AES. Or really any symmetric construction, come to think of it.
- bascule 12y agoIt isn't used for symmetric encryption algorithms. They're more easily made verifiably constant time as described in the blog post. It's a common way to protect something like RSA from timing sidechannels, however.