0

Premise: When looking up a secret value in a DB (API key, token, maybe username) it's near-impossible to guarantee that the lookup doesn't leak something about the similarity of the candidate value to an existing value. So it makes sense to force such an operation to be constant time.

Question: When doing so, it is necessary to maintain the constant-time restriction when the lookup succeeds?

My feeling is that there's no reason to force successful lookups to be constant-time, but I'm afraid I'm not thinking of something.

One possible scenario for when it would matter is if you wanted to hide the success-ness from an observer (who can't otherwise see the response, because of TLS, say). But that seems pretty fringe (or at least not of concern to me at this time).

1
  • The problem you describe here is about the hacker distinguishing between "definite failure" (constant time) and "possible success" (might be more or less time than failure). You already answer this problem yourself: "not of concern to me at this time". It surely might be of concern in other use cases than yours though, but it really depends on the use case. So there is no general "okay" only a "you think it is ok in your situation". If you want a less generic answer you need to present a less generic use case. Commented Mar 29, 2023 at 22:47

1 Answer 1

1

Constant-time computing is used to avoid revealing information about secret values. If the machine acts differently, e.g. takes longer to respond or uses different resources to generate the response, then that says something about the relationship between a guess and the secret value.

If the processing of all failing requests is indistinguishable then that should prevent an attacker from gaining (most*) information about the secret value. An attacker gets to know if their guesses are correct or incorrect but this doesn't allow for any attacks more efficient than brute-force.

I am wondering how one would implement this through. If the program is to execute differently based on whether the guess is correct or not then this is a constant-time comparison that needs to be made first, and then you might as well just return the result of that comparison.

Here's an article that presents some common pitfalls when implementing constant time functions, and I think it brings up points that are relevant for this question.
https://www.chosenplaintext.ca/articles/beginners-guide-constant-time-cryptography.html



* An attacker could potentially gain some knowledge about the secrets by eavesdropping on legitimate users and seeing the difference in processing between their successful and unsuccessful guesses. This would be a much more difficult attack to perform than if they could analyse their own requests and is probably (from my understanding) not viable in the vast majority of cases. The exception would be if legitimate users send many correct and incorrect guesses to the application.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .