[Jean-David Beyer]
> Aside from the necessity to compromise the machine running
> gpg to get the
> timing data for this attack,
> just how much data can a timing attack retrieve from a
> multiprogramming
> system, such as UNIX, Linux, etc., anyway, since all the
> other processes
> running at the same time, which could include web servers,
> file servers,
> database servers, name servers, mail servers, etc., would
> really add a lot
> of noise to the data obtained?
In the attack, signal-processing techniques were used to remove or
smooth the noise in the timing data. In fact, the demonstration server
he "attacked" was running OpenSSH on Linux, meaning it was servicing
hardware interrupts and the like, adding at least some noise to the data
collected.
I presume that more noise in the system means more data collection is
needed to find "accurate" timings and therefore extract the key, but I
know just a tiny bit about signal processing from one college class, so
I am no authority on the matter.
Regards,
Ryan
_______________________________________________
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users
