6 ms·
> instead of speed Not when developing crypto. You have to look at execution speed, too, to prevent timing attacks.
by pilsetnieks 12y ago
> instead of speed
Not when developing crypto. You have to look at execution speed, too, to prevent timing attacks.
- raverbashing 12y agoExecution speed variance It doesn't matter if it takes 1s or 10s, but that it takes 10s every time (to verify a password, for example)
- azdle 12y agoWhy would that matter in the case of testing for correctness? I thought these 'runable spec' implementations were only to verify that the output of the 'real' implementation is correct and thus would never even be used anywhere that could/would be attacked. Am I not understanding the purpose correctly?
- Igglyboo 12y agoWhen testing for correctness why would you care about timing attacks? You would obviously have multiple tests covering correctness, performance, security, etc.