Re: const time authentication in bozohttpd

Joerg Sonnenberger <[email protected]> wrote:
> On Wed, Jun 25, 2014 at 08:08:57PM +0100, Mindaugas Rasiukevicius wrote:
> > "Terry Moore" <[email protected]> wrote:
> > > Perhaps this is a silly comment; but wouldn't it be easier to simply
> > > time stamp the incoming request, and then spin for any authentication
> > > failure until a suitable fixed time has elapsed after the inbound
> > > arrival? Or are you worried about local cache-interference attacks as
> > > well? 
> > 
> > Why fixed time?  Make it random time.
> 
> Random noise can be filtered out moderately easy.

If you add it on top of the memcmp(), then yes.  Not if you make the total
time random (take a timestamp from before the operation), just need ensure
that it is above the upper bound.

-- 
Mindaugas