Timing attack threatens private keys on SSL servers Security researchers have discovered a "timing attack" that creates a possible mechanism for a hacker to extract the secret key of a TLS/SSL server that uses elliptic curve cryptography (ECC). Elliptic curve cryptography is a type of public-key algorithm that uses the maths of elliptic curves rather than integer factorisation …
I understood the article just fine...I was making a wordplay on "cryptic"...perhaps the joke alert would have been a more appropriate icon.
i understand the article so well that I wonder why they don't use a random delay in the algorithm, rather than a set time to compute. The random delay would be interesting, because attackers would not know if they were facing an encryption algorithm that was vulnerable to such attacks, or one that was smart enough to randomly delay. As such, they may waste time attempting timing attacks.
Most random number generation is itself predictable, so a badly implemented random delays would probably give you an entry into the system.
The only random delay that would work and prevent intrusion is adding a random amount onto a fixed delay which is guaranteed to be longer than the time to compute, thus completely hiding the compute time.
No this is the result of a ladder function being directly sensitive to the length of the input. Probably done in an effort to make the ladder function as fast as possible, rather than as consistent as possible. (I.e, it's not timing as in when you make the request, but timing as in how long the request takes to process.)
Their fix makes the ladder function consistent. Me, I'd fix it by adding a random delay adjusted for the input length, thereby teasing fuzzers with what initially looks like it might be a timing exploit candidate but leads to garbage. But I'm a jerk.
This post has been deleted by its author
This attack, and a robust counter-measure to it, were published in 2005 in "Advances in Elliptic Curve Cryptography" (Blake, Seroussi, & Smart - editors). So you are wrong to say 'Security researchers have discovered a "timing attack"'. If you had taken the trouble to follow your own link and read the Abstract there, you would have seen that all the Secutiry Researchers have done is to take this hackneyed old idea and show that OpenSSL is still vulnerable to it.
This attack, and a robust counter-measure to it, were published in 2005 in "Advances in Elliptic Curve Cryptography" (Blake, Seroussi, & Smart - editors). So you are wrong to say 'Security researchers have discovered a "timing attack"'. If you had taken the trouble to follow your own link and read the Abstract there, you would have seen that all the Secutiry Researchers have done is to take this hackneyed old idea and show that OpenSSL is still vulnerable to it.
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2024
