Hacker News Reader

Maybe this is overly naive, but I always wondered whether timing side channels could be mitigated by scheduling authentication responses before doing the crypto calculations.

1. authentication request arrives

2. schedule response at a later time, generously leaving time for doing the next step

3. do part of the work that is sensitive to timing attacks

4. respond at scheduled time

View on HN

That applies over a network. It doesn't apply to someone that has physical access to the machine. Even if the machine delays a response, the power profile of the computation will tell the exact timing of the computation.

Since there is lots of cryptography used to keep users out of their own hardware (or stolen hardware) these days, this is important.

Reply on news.ycombinator.com