openssh: timing attack leads to information disclosure

openssh: timing attack leads to information disclosure

Posted Dec 2, 2004 10:28 UTC (Thu) by addw (guest, #1771)
Parent article: openssh: timing attack leads to information disclosure

This sort of attack has been talked about before, surely it would be easy to fix by putting something like this at program start:

start = time(0);

and then in the appropriate places:

now = time(0);
sleep((start < now) ? 0 : 1) + rand() % 4);

---

(Log in to post comments)