On Wed, Jun 15, 2005 at 10:05:09AM -0700, Kastus wrote:

On Wed, Jun 15, 2005 at 12:20:47PM +0200, Sven 'Darkman' Michels wrote:

...

FYI: http://www.daemonology.net/hyperthreading-considered-harmful/

According to http://news.netcraft.com/archives/2005/05/20/researcher_attack_could_expose_..., it's not hyperthreading-specific. If you follow the link on that page to http://cr.yp.to/antiforgery/cachetiming-20050414.pdf you can see how to recover all 128 bits of a randomly-generated AES key in around a day on P3 without multithreading.

Yes, but this is another issue. It is based on the AES implementation that uses secrets for calculating indices to an array (s-box cache). (But DJB also points out other (hardware, CPU) sources that can lead to timing-attacks) AFAIK the OpenSSL developers prepare patches for this too to create a constant-time AES (maybe others?) implementation. BTW, ever tried the code attached to Bernstein's paper? Does it work?

-Kastus

-- Bye, Thomas -- Thomas Biege , SUSE LINUX, Security Support & Auditing -- Ray's Rule of Precision: Measure with a micrometer. Mark with chalk. Cut with an axe.