Collaborate Disseminate
I’ve been researching timeless timing attacks, ie: timing attacks using concurrency rather than round trip time. Here is an article by portswigger with links to the original article by Van Goethem. Basically it says that if you pack two re… Continue reading Timeless timing attacks and response jitter
Assuming I am using different secrets/keys for each MAC pass, does running both MtE and EtM creates any vulnerability?
This is what I mean about doing MtEtM:
K0 ≠ K1 ≠ K2
addMAC(msg, K) = msg || MAC(msg, K)
ciphertext = addMAC(encrypt(addM… Continue reading Is is safe to use MtEtM? (MAC-then-Encrypt and Encrypt-than-MAC) [migrated]
I want to measure the execution time of a function. The execution time of this function is only slightly different in the two cases. Is there any way I can accurately measure its time to distinguish the two cases?
The possible solutions ar… Continue reading In the time side channel, is there any way to improve the measurement time accuracy?
I know the title isn’t good at all but allow me to explain. In this model I have n devices on different networks that are able to communicate with each other. A supervisor is able to see every packet a device sends or receives. How can two… Continue reading What mitigations are there against a timing attack done to find which devices are communicating on a set of devices?
I had a discussion with a friend today about his password hash comparison. I argued that you can’t return false on the first hash mismatch you have and I sent him a link to an article about a Java timing attack that happened in Java 6.
pub… Continue reading Timing attacks in password hash comparisons
Problem
I am putting together a proof of concept for the FLUSH + RELOAD attack. The method is outlined in great detail in this paper. The general idea is simple – cached addresses can be accessed with much greater speed than addresses not … Continue reading FLUSH + RELOAD Proof of Concept – Why do we need to flush more than needed?
I’ve seen code like this:
if(password.length !== allowedPassword.length || !crypto.timingSafeEqual(password, allowedPassword))
So timingSafeEqual is supposed to use the same amount of time to compare 2 passwords, in order to prevent the … Continue reading Using timingSafeEqual
I’m trying to understand and perform the Prefetch Side-Channel Attacks:Bypassing SMAP and Kernel ASLR. The author have released the proof-of-concept code.
I’m trying to run the attack on my Intel Haswell machine, using Linux Ubuntu 20.04, … Continue reading Prefetch Side-Channel Attacks:Bypassing SMAP and Kernel ASLR
Consider this common example used to demonstrate timing attacks:
async def sign_in(username, password):
user = await get_user_from_db(username)
if user is None:
return False # early return 🙁
password_hash = slow_hash(passwo… Continue reading Use delay with a fixed total time to defend against timing attacks
I am building a web app that allows login with an email and password. I understand that I need to use a timing safe function to compare the passwords to prevent timing attacks. However I realized that the emails might be vulnerable to the … Continue reading How to preventing timing attacks against values used for authentication, like emails, stored in Databases?