NateLawson

44 ms·

1. 361.▲
   by NateLawson 17y ago

   Yes, the conventional wisdom is that C is less secure than high-level languages. If you're talking memory management, that's correct. DJB does nothing but stack variables for NaCl to avoid performance and potential for memory leaks. But for
2. 362.▲
   by NateLawson 17y ago

   The important thing that probably isn't obvious is how few samples you actually need. Jitter is essentially random, which means it is decorrelated from the repeated pattern (1 compare takes longer, 255 take the same time) With the added noi
3. 363.▲
   by NateLawson 17y ago

   I disagree with your first statement. Non-experts will make more trivial errors. But I think we do agree that being an expert does not change the need for third-party review.
4. 364.▲
   by NateLawson 17y ago

   I have found this exact bug (MAC compare timing attack) in three different products over the past few years. I could only talk publicly about this one. The fact that it's so common indicates it hasn't been publicized well enough, especially
5. 365.▲
   by NateLawson 17y ago

   This attack was found by Bodo Moeller in OpenSSL. I posted about this here, including a link to the slides: http://rdist.root.org/2008/01/25/tlsssl-mac-security-flaw/
6. 366.▲
   by NateLawson 17y ago

   Yes, and the whole fact that something this important is being left up to the user is my point.
7. 367.▲
   by NateLawson 17y ago

   I'll be giving a talk at Yahoo Security Week in June entitled "When Crypto Attacks!" I hope to post slides afterward. If you find yourself needing to implement crypto, it's likely you can avoid it by thinking about the situation differently
8. 368.▲
   by NateLawson 17y ago

   However, if the messaging layer provided ordering and uniqueness guarantees, that same code could not be compromised. Also, your comments seem to be specific to SimpleDB. Is it possible other components that depend on AWS-Auth have related
9. 369.▲
   by NateLawson 17y ago

   Yes, this is moving toward what I was trying to say. Sorry if that wasn't clear. But I think the answer is not more documentation but handling this for the developer at a lower layer. And instead of Amazon implementing this lower layer them
10. 370.▲
    by NateLawson 17y ago

    Hi Colin, I decided to jump in here. Can you point to an AWS doc explaining how every operation is idempotent, including all combinations of them? I have a hard time understanding how something like "ADD USER 1", "DELETE USER 1", "ADD USER