phc-discussions - Re: [PHC] omegacrypt and timing

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <541954D2.2040901@ciphershed.org>
Date: Wed, 17 Sep 2014 05:30:58 -0400
From: Bill Cox <waywardgeek@...hershed.org>
To: discussions@...sword-hashing.net
Subject: Re: [PHC] omegacrypt and timing

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1



On 09/17/2014 04:56 AM, Krisztián Pintér wrote:
> can someone explain me how omegacrypt does not leak secret through 
> timing? i mean total runtime, not cache timing.
> 
> in the central part, we derive 0..3 number B from the secret, and 
> based on that value we do different branches that has different
> number of operations. B will on average have all possible values
> with the same probability, but there will be a deviation. therefore
> for two given passwords, the total running time is different.
> 
> i understand that memory latency screws up such fine grained
> timing, making practical attacks difficult. but theoretically there
> is a leak. am i right?
> 

Yes, OmegaCrypt leaks some data through runtime.

However, AntCrypt, OmegaCrypt, and Schvrch all tried to introduce data
based branching for GPU defense, and "cyclomatic complexity".  I am
not sure we've seen this idea implemented well yet, and data-based
branching has been considered a no-no for years apparently.  However,
when 3 authors all invent the same thing, I think we should take a
closer look.

Bill
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBAgAGBQJUGVTPAAoJEAcQZQdOpZUZjv8QAI2ZmFDJfoa1G2/4SkRJ5eQr
m7pSXp6OI8EWJP6YJof3GDgwhk5ueysqkB5pdCuqEpLXTq6zS/DhT9ERk5Z0nTJC
dwgYyRKcR3IKenPxZT6FxQvhYwRjubRc9dIoRW0ORqWovFkcS8rQSmJaQ8wiYUMb
9uNXZ2aF+Z+nEJ5D1wf2oWmwwpCa1lc17NwVIx2GhLwNl9/DMdcGuQxmWhEU/pO2
yenWux6j1gObsucEsgJN2nz+DM8XTgqehY8NINoI07l9czH4bveKAcIGQ/q+vqze
wiHtmJm3IOYSX4SVweUOGpOWJ5bqoTt6kgvJnhmFew3cL9h20aKwhEhtnkLOYbbB
7yO8wUVW6DrKmt1HOG5ZW5je3J0Ul+k7rTLVzKMD7kHLRm79fU6r0fY+04WTI+do
sXZ1kuiw36oy8vggpDekONyNDHuNWWM73YTLaoPUH/CXlbNeaeccBFdOFKrzFEiA
vmZf+9FP7rXrc2ysJ6wz2XrbEhQC2ZguyhFH6Vr95XVzak2/x+ZQ6EJ7dudc/avw
X53OolGhmA2SEJlDBd4NqGb4l9X6xeV4do501iZd5KyOeAfpgSpbLwnSFLTL4aWW
HmNUbL0lRYUbomsvsRJfvN9z1n4mozDI5uSyb41ZTaY5JoBP5nPOYPvjH30VtrtC
rQYdGK3c0vYsnICNWrqj
=R2xE
-----END PGP SIGNATURE-----