A Lesson In Timing Attacks (or, Don't use MessageDigest.isEquals)

Re:A Lesson In Timing Attacks (or, Don't use MessageDigest.i... by sophacles on Thursday August 13, 2009 @12:41PM (#761147)

Not really, if this attack is doable over the internet, which will have latencies randomly[1] distributed (in a normal curve), rand does not actually do anything, well maybe require a few more sample points to get that noise out.

[ Parent | on HN ]

Re:A Lesson In Timing Attacks (or, Don't use MessageDigest.i... by naz on Thursday August 13, 2009 @12:56PM (#761190)

That makes sense, maybe sleep(rand(1.0 - time_spent))

[ Parent | on HN ]

Re:A Lesson In Timing Attacks (or, Don't use MessageDigest.i... by naz on Thursday August 13, 2009 @12:57PM (#761192)

Or just sleep(1.0 - time_spent)

[ Parent | on HN ]

Re:A Lesson In Timing Attacks (or, Don't use MessageDigest.i... by JacobK on Thursday August 13, 2009 @07:06PM (#761953)

Or just don't short circuit ever, and do the entire computation every time.

[ Parent | on HN ]