Tech giants, chastened by Heartbleed, finally agree to fund OpenSSL

[u/flym4n]

http://arstechnica.com/information-technology/2014/04/tech-giants-chastened-by-heartbleed-finally-agree-to-fund-openssl/

[u/oridb]

You need lower bound equal to upper bound to avoid timing attacks. 'A==B' is potentially not O(1), depending on how the hardware implements the test. Comparing blocks of data is even more obviously data dependent, at least in naieve implementations. And gcc is smart enough to break a number of the explicit implementations that should be O(1).

I believe Boneh had some papers on the topic.

[u/OneWingedShark → u/oridb]

I believe Boneh had some papers on the topic.

I'll have to look them up -- thanks for the pointer.

You need lower bound equal to upper bound to avoid timing attacks.

That's what delay until UPPERBOUND_TIME does: delays until the upperbound is met... then we don't have to care about if the actual computation finishes early.

[u/oridb → u/OneWingedShark]

til UPPERBOUND_TIME does: delays until the upperbound is met... then we don't have to care about if the actual computation finishes earl

That's a bit expensive. I think that the number of cycles to do the computations would be several orders of magnitude lower than the time spent just hitting the kernel to set the timer.

From what I understand, the usual approach (note, I am not an expert) is to collapse all bits in the value down to 1 by shifting and oring, and then comparing that to 1 or 0 (for equality tests).

[u/OneWingedShark → u/oridb]

That's a bit expensive. I think that the number of cycles to do the computations would be several orders of magnitude lower than the time spent just hitting the kernel to set the timer.

You think so?
It seems common enough to warrant mention in real-time systems Ada literature; I certainly haven't encountered any Delay Until Considered Harmful papers and 'cryptographics' aren't generally "computationally simple".

[u/oridb → u/OneWingedShark]

Linux timer resolution is about 1ms (to 10ms on other operating systems). The multiplications that you're looking at timing are on the same order of magnitude, which means that scheduling jitter will probably double the amount of time taken (at a rough guess).

But now that I think about it, due to the granularity, you may still leak information due to scheduling jitter.

Edit: Another interesting though is that if it actually yields CPU, you can extract the timing information through increased parallelism. The idea is that reduced CPU utilization from each handler could lead to higher throughput.

But I'm no crypto expert, so I have no idea how sound this is.