Re:SSH gets protection against side-channel attacks
by peteretep on Friday June 21, 2019 @09:35AM
(#20242342)
Just to clarify my understanding, the reason for doing this is so that random sampling / leakage of the contents of the RAM stops being useful, you need to specifically get the key (and then presumably a whole chunk of encrypted RAM to decrypt?)?
[ Parent
| on HN ]
Re:SSH gets protection against side-channel attacks
by reza_n on Friday June 21, 2019 @09:51AM
(#20242457)
Yup. When something goes wrong in these kinds of applications, you sometimes tend to just randomly dump memory, which is a huge data leak. Or even worse, if someone figures out a way to force a data leak, then your are completely compromised. Having each piece of data with its own key and that key is a combination of data outside of the process address space drastically lowers the chances of data leakage and total compromise.