Boris Kogan’s Post

for those of us tasked with making sure our code is secure we're always looking for ways that rogue agents can outsmart us. a while back i came across an article describing a timing attack by which adversaries would probe the system with inputs of various lengths to learn about system internals. it got me thinking and this is what i came up with. this routine will compare two equal length buffers in the same time whether they are identical or not. what do you think? is this helpful? would you care to see more coding tricks and tips in the future?

  • text

Thanks, interesting trick. Its the only problem is that this code could theoretically give false positive due to uint32 overflow. You could replace it with uint64 and reduce the chance of the problem. I'm wondering, if it is possible to implement this code without even theoretical possibility of false positive? Will think about it on my way home... And yes, I'd be curious to see more tricks like this. Or unlike this. Both.

Like
Reply

To view or add a comment, sign in

Explore content categories