121
votes
Meltdown and Spectre Attacks
This answer is an attempt at addressing simply the main concerns. The details here might not be exemplary accurate, or complete. I'll try to link to more detailed explanations when possible.
What is ...
- 13.1k
39
votes
Accepted
How can I prevent side-channel attacks against authentication?
From the code example provided, it is possible to determine the correct password by timing the code when given various inputs.
First, you shouldn't actually examine the password directly! At the ...
- 2,674
24
votes
Accepted
How are code-branch side channel attacks mitigated on Java?
While you can make some attempt towards constant-time code in general purpose JITed languages like Java, you generally run into some problems:
The runtime implementation is, generally, intended to be ...
- 136k
19
votes
Does having no 'if' blocks in code mitigate side-channel attacks?
Not just if.
You will have to remove all functions, methods, lambdas, classes, loops, whiles, exceptions, polling, switch, if, lookup tables, jump tables.
You will then have no need for tests, ...
- 605
12
votes
Are variable time comparisons always a security risk in cryptography code?
No, they are not always a risk, and indeed, it is impossible to build a practical cryptographic library where every function is constant time.
Take, for instance, a decryption function. In a real-...
- 36k
11
votes
Accepted
Does having no 'if' blocks in code mitigate side-channel attacks?
Removing branching would probably mitigate these problems. But so what? If you remove branching you essentially remove the need for a general purpose computer, and you're left with something that can ...
- 17.6k
9
votes
How sensitive are acoustic side-channels to compression with a narrowband codec?
According to Wikipedia:
"... G.711 passes audio signals in the range of 300–3400 Hz and
samples them at the rate of 8,000"
Nyquist criteria limits the top frequency to be less than half ...
- 8,213
9
votes
Does having no 'if' blocks in code mitigate side-channel attacks?
Unfortunately, even aside from the other issues mentioned, compilers can produce conditional execution even in cases where you did not explicitly write a conditional. This most commonly arises from ...
- 190
7
votes
Meltdown and Spectre Attacks
Simple tips
In addition to M'vy's excellent answer, I just want answer this question:
What can I do in order to be safe?
Spectre, Meltdown and Rowhammer are CPU conceptual bugs, so they couldn't be ...
7
votes
Accepted
What are the new MDS attacks, and how can they be mitigated?
My current understanding is that the microcode update changes the
behavior of the obsolete VERW instruction so that it causes a flush of
various internal processor buffers
The new behavior of the ...
- 315
6
votes
Simple defense against power analysis?
You should not plug a washing machine into the same power strip as your computer or put a large number of switches in series unless you want to burn down your house. With that said...
Mitigating power ...
- 67.3k
6
votes
Are variable time comparisons always a security risk in cryptography code?
Variable time comparisons will leak information. If there is no harm in revealing the data being compared, then there is no issue with using variable time comparisons. If it is crucial that it remain ...
- 1,766
6
votes
How can I prevent side-channel attacks against authentication?
I assume that the code from the question is just an intentionally trivialized example for illustration, because in a real-world system you would never store passwords in plaintext. But if you would ...
- 49.6k
6
votes
Can string comparison realistically be exploited in a timing attack on a web server?
Timing attacks are possible even if response times seem inconsistent, because you can use statistical analysis to filter out a lot of noise in the data. Average values are much more stable than ...
- 15.9k
5
votes
Meltdown and Spectre Attacks
This answer is specific to the Spectre Next Generation attacks and will be updated as soon as new information are available.
Update, May 22nd:
The first patches are coming and so are more ...
- 8,021
5
votes
Can Spectre be fixed in future hardware simply by purging CPU caches?
Any side-effect of speculative execution that is visible can be used. There are some (perhaps many) side-effects that don't involve the cache at all.
From the Spectre whitepaper:
... In this ...
- 2,383
5
votes
Does having no 'if' blocks in code mitigate side-channel attacks?
There is no IF statement at the CPU level and it is unclear which programming language with if statements you refer to. But depending on the programming language various statements will result in ...
- 208k
5
votes
Accepted
Does this theoretical salted-hash-sleep scheme mitigate timing attacks?
Assumptions
Knowing how long TimingVulnerableOperation(clientInput, ...) takes is sufficient to reveal everything about the internal state of the function, including the value of serverSecret.
A ...
- 67.3k
4
votes
Accepted
Principles of cache attacks
Apparently, this topic arouse great interest to many of you. After having done some more research, I presented the CacheBleed attack to a group of scientists last month. Now, I would like to share my ...
- 535
4
votes
Keyboards immune to signal monitoring?
I'm a bit surprised none of the other posts provide a definitive answer to such an objective question. Keyboards certified for USA NSTISSAM / NATO SDIP-27 (EMSEC standards that specify, among other ...
- 67.3k
4
votes
Accepted
How does the side channel actually access the contents of kernel memory in Meltdown?
The part of the document you are interested in is :
Based on the value of data in this toy example, a different part of the cache is accessed when executing the memory access out of order. As ...
- 13.1k
4
votes
Accepted
To what extent are countermeasures against side-channel attacks effective/ used regularly by everyone?
is it true that most of them do not offer absolute privacy, but rather they only reduce risk?
No, many of them completely eliminate the risk. Using constant time implementations of algorithms and not ...
- 67.3k
4
votes
Accepted
If rowhammer only results in capacitor discharge, how can it flip 0 to 1?
Rowhammer only works by accelerating the discharge of capacitors.
Cells don't get charged by rowhammer, only discharged. The reason you may see a logical 0 change to a logical 1 is that modern DRAM ...
- 67.3k
3
votes
How does the side channel actually access the contents of kernel memory in Meltdown?
The attacker asks the CPU to do something that takes a long time, such as a complicated bit of math. Real execution gets stalled, so the next few hundred instructions get executed speculatively, with ...
- 34.8k
3
votes
Accepted
Does OpenSSH use padding of random lengths?
As per this article it does not, but I arrived at this topic seeking confirmation of this article to begin with so take it for what it's worth. The relevant quote from the article is:
OpenSSH does ...
- 46
3
votes
Change the function such that there are no more side-channels
Both of your suggested implementations have issues.
The first one fails because you still have to worry about timing when comparing hashes, and the == operator is almost certainly not constant time.
...
- 15.8k
3
votes
Are variable time comparisons always a security risk in cryptography code?
First, cryptography is a broad term and the Python cryptography library does not only include primitives but also X.509 handling etc.
The main question is if the timing issues can be used by an ...
- 208k
Only top scored, non community-wiki answers of a minimum length are eligible