News for hackers. Stuff that matters.
Re:CacheBleed: A Timing Attack on OpenSSL Constant Time RSA by stygiansonic on Tuesday March 01, 2016 @05:01PM (#11206461)
This is unlikely to help against a determined adversary. The reason is that the bias introduced by the timing differences can still be detected using statistical methods, provided you have enough samples. (In general, I would expect that you'd need more samples when the randomness is large relative to the timing attack difference)

See this blog post [1] for examples of how differences as small as 20 microseconds over the Internet could be detected, despite the effect of latency. Latency can be considered a random variable, albeit maybe not with the same distribution as a RNG, but the same principles likely apply.

1. http://rdist.root.org/2010/07/19/exploiting-remote-timing-at...

There are no comments on this comment yet.