Re:The definitive guide to “modulo bias” and how to avoid it...
by some_furry on Thursday September 15, 2022 @07:29AM
(#32850161)
We don't consider "leaks the length of a SHA256 hash" to be a valid timing attack in most protocols for similar reasons (i.e. it's public knowledge).
When developers encounter timing attacks in their code, they often invent really dumb ways to side-step the length "leaking".
This might be understandable if it was a MAC then Encrypt protocol with PKCS padding (hello lucky13), but instead this comes up in the context of "validate this HMAC-SHA256 tag for our JWT-like protocol".
When developers encounter timing attacks in their code, they often invent really dumb ways to side-step the length "leaking".
This might be understandable if it was a MAC then Encrypt protocol with PKCS padding (hello lucky13), but instead this comes up in the context of "validate this HMAC-SHA256 tag for our JWT-like protocol".