4 ms·
Assume you have two doors, one guaranteed to only allow randomly selected women to walk through it, and one similar one for men. For weird reasons, you're unab
by patio11 11y ago
Assume you have two doors, one guaranteed to only allow randomly selected women to walk through it, and one similar one for men. For weird reasons, you're unable to make any judgement about the person coming through the door except height. This is sufficient to figure out which door is which: on average, women are shorter then men. After that, it is a high school statistics exercise.
Suppose in addition to being unable to distinguish a man from a woman you are also not really good with your ruler and each person is recorded at 6 +/- 6 inches above their true height. Does this make it impossible do distinguish the women's door from the men's?
Not in the slightest: the averages are now wrong, but they're still different. It's still a high school stats exercise. It's a very important thing for science that a real world which easily permits measurement errors like this doesn't by itself make science impossible.
Most timing attacks on e.g. HMAC functions are the door problem in disguise: we know there is going to be a fast code path (e.g. early termination of a string comparison) and a less fast code path (e.g. a string comparison which had to examine every character). You're allowed to take an arbitrarily large number of measurements -- determine whether you're on the fast path or the less fast path. Great, you just solved N bits of the problem -- now, do that in a for loop and you win.