SSH gets protection against side-channel attacks

Re:SSH gets protection against side-channel attacks by rocqua on Friday June 21, 2019 @11:54AM (#20243618)

> in fact one could argue that, the higher the quantity of memory chunks is, the harder it is to correctly decrypt the original private key; although to me this has the security through obscurity smell

I am not sure this is a bad place for security through obscurity. ASLR is similar. The thing is, here we are not using this is a primary mechanism. (that would be preventing RCE) Instead, this would be a secondary 'defense in depth' measure meant to make it harder to deploy an exploit after you have been compromised.

For such a second layer of defense in depth, obscurity is a decent option. Things go wrong if you start relying on your obscurity to do anything but slow down an attacker.

[ Parent | on HN ]

Re:SSH gets protection against side-channel attacks by viraptor on Friday June 21, 2019 @02:40PM (#20245229)

I feel like the should be a different name for that class of mitigations. Probabilistic security maybe? Security through obscurity for me is "we won't publish our algorithm". But that's not the same as ASLR or memory encryption which targets specific type of attack by adding probably-too-high randomness to the attack path.

[ Parent | on HN ]