Re:CacheBleed: A Timing Attack on OpenSSL Constant Time RSA
by philh on Tuesday March 01, 2016 @01:02PM
(#11204614)
(Not at all confident about this.)
AngrySkillzz aside, I think there's another reason this won't work. From the sound of pimterry's explanation, the timing effects happen in your own code, not OpenSSL's. It's not "hit the cache to slow down OpenSSL", but "hit the cache and see if OpenSSL slows me down". Adding random delays to OpenSSL wouldn't help guard against that.
AngrySkillzz aside, I think there's another reason this won't work. From the sound of pimterry's explanation, the timing effects happen in your own code, not OpenSSL's. It's not "hit the cache to slow down OpenSSL", but "hit the cache and see if OpenSSL slows me down". Adding random delays to OpenSSL wouldn't help guard against that.