The tag has no wiki summary.

learn more… | top users | synonyms

7
votes
1answer
144 views

Deanonymizing users by introducing structured delays to the network?

Here is a scheme for deanonymizing a user that I've been thinking about, just out of curiosity. I tried searching for it but didn't find much. Does this technique have a name? Are there any papers or ...
0
votes
1answer
44 views

Timing Attacks in RSA

Considering the classic scenario of Eve trying to listen in to Alice and Bob's conversation, if Eve can intercept messages between Alice and Bob but with no access to their computers would Timing ...
0
votes
1answer
77 views

Are there any working proof-of-concept comparison timing attacks?

I've tried to reproduce a string comparison timing oracle in two languages (Java and Python), but I'm not seeing any correlation in the timing based on the input into the comparison. Are there any ...
11
votes
3answers
284 views

Timing Safe String Comparison - Avoiding Length Leak

Let's say that we're building a generic timing-safe comparison function for general purpose use. Making it so that it is safe when both strings are equal length is pretty well known. However, what I'm ...
8
votes
2answers
131 views

How does SSH defend against keystroke-timing attacks?

This paper: https://www.usenix.org/legacy/events/sec01/full_papers/song/song.pdf Explains how SSH can be compromised by analyzing the timing of the keystrokes to guess what the user is typing. It's ...
3
votes
2answers
303 views

Does bcrypt compare the hashes in “length-constant” time?

I saw this function slowEquals() while reading Salted Password Hashing - Doing it Right, which uses a byte-level xor comparison to avoid timing attacks. I was wondering whether this is what Bcrypt ...
0
votes
1answer
64 views

How to specify a Snort rule connection duration?

Is it even possible to specify into a snort rule the duration of a connection? For example: in this format Hour, Minute, Second H, M, S = 0, 2, 1 If a connection that has the duration of 2 minutes ...
3
votes
1answer
124 views

What are security implications of enabling access to performance counters on ARM Cortex A9?

On an ARM Cortex A9 core, privileged instructions have to be executed so that unprivileged code can use performance counters. For instance with this GCC inline code, which would have to be run in a ...
3
votes
2answers
539 views

Is it reasonable to prevent timing attacks by using fixed processing time

I have systems that perform cryptographic operations within a SSL/TLS tunnel. My concern is that I may leak timing information when encrypting, decrypting, or hashing. Part 1 Is it a good idea to ...
7
votes
2answers
198 views

Can't explain data from side channel attack attempt

I found the comparison function below (slightly modified) from a crypto library I was using. I was curious about the potential vulnerability to side channel attacks. Specifically, the character ...
-2
votes
1answer
134 views

Why did I get unresponsive script when I start my system and open web browser? [closed]

The script on opening web broswersays Warning: Unresponsive Script A script on this page may be busy,or it may have stopped responding.You can stop the script now,or you can continue to see if the ...
13
votes
1answer
1k views

Timing attacks on password hashes

Timing attacks can have a devastating impact in scenarios where the secret is involved, often in cases where byte-wise array comparison is used. Now there are those that advertise using constant ...