It's All About Time – Remote timing attacks in PHP • Hacker News Board

Post by sarciszewski » Sun, Nov 30, 2014, 4:14 AM UTC

jasonlotito wrote: post #42

sarciszewski wrote: post #34

Earlier quoted context omitted.

The second you say "install this PECL extension" people hop on the fast train to nopesville. That is the problem I ran into getting people to adopt libsodium :\

I honestly don't see why. It's easy enough to install pecl extensions.

It's an extra dependency. Often, people don't even have php5-dev installed, so it's more than one step to get it done. (Even that first additional step is more work than people are willing to put forth!)

Especially since all this does is patch the behavior of one function. :|

And if you have PECL, you might as well go all the way and install libsodium.

Post by bmm6o » Sun, Nov 30, 2014, 4:23 AM UTC

totony wrote: post #6

Interesting article, I never took the time to really think about this. For optimal security, OP mentions that we should fix the underlying code, but I kind of disagree. Understanding all the underlying code is a lot of work and, except for extremely secure application, is not really needed. Also, hindering performance for security is not always the way to go (he mentions returning only at the end). If you have ultra-…

Here's part of the response I wrote last time this came up (https://news.ycombinator.com/item?id=8602494):

An approach where you watch the clock will be inherently less portable and actually much harder. Not only will the timing calls be hardware or OS specific, but so will the worst-case time. Imagine having to deal with a chip going into low power mode during your computation. Also you probably don't want to count time that your thread wasn't scheduled to run, so now you're talking about integrating with the scheduler.

It's All About Time – Remote timing attacks in PHP

Re: It's All About Time – Remote timing attacks in PHP

Re: It's All About Time – Remote timing attacks in PHP