Re:CTTK: Constant-Time Toolkit
by platz on Sunday February 25, 2018 @02:47PM
(#16460777)
I think the ability to actually exploit timing attacks is bit over indexed. Almost all of the time you need direct access on the machine, i.e. not a webserver. So it's more of a concern for native environments as opposed to networked environments.
[ Parent
| on HN ]
Except for the fact that virtually all modern serverside applications live on shared hardware with anonymous cotenants, and all modern clientside applications are JIT'd from random websites, but sure.
I'm not sure why you believe that, since your belief runs contrary to the real-world oracular attacks against .Net and Ruby on Rails. Also, see Lucky-13, POODLE, and Logjam.
If the system being attacked does not limit attempts, one might repeat their requests until they achieve statistical significance. The first Stripe CTF had a level that dealt with timing attacks, and that is the approach I took.
You should read "Remote Timing Attacks are Practical" (https://crypto.stanford.edu/~dabo/papers/ssl-timing.pdf) published in 2003 by David Brumley and Dan Boneh.