News for hackers. Stuff that matters.

A comment on AMD: Microcode Signature Verification Vulnerability. Parent comment

Re:AMD: Microcode Signature Verification Vulnerability by Muromec on Monday February 03, 2025 @06:13PM (#42924723)
> If RDRAND is surreptitiously replacing all your random numbers with AES of the current time, you cannot find that out from observing behavior.

Should you not see it from timing alone being wrong?

[ Parent | on HN ]
Re:AMD: Microcode Signature Verification Vulnerability by usrusr on Monday February 03, 2025 @07:11PM (#42925324)
Had the same thought. But then on the other hand, when nobody is looking at the timing, nobody will see anything. And those who do see a timing artifact, will they really dig deeper or will they just shrug off another oddity? I would not like to bet on another Clifford Stoll in this day and age.
[ Parent | on HN ]
Re:AMD: Microcode Signature Verification Vulnerability by Tuna-Fish on Tuesday February 04, 2025 @10:45AM (#42933872)
RDRAND is very slow and you can fix up the timing with a slowdown loop in the microcode.
[ Parent | on HN ]