Identify components which are vulnerable to timing attack about qabel-core HOT 8 CLOSED

Use the threat model docu wiki page if something has been found and discussed in this issue.

from qabel-core.

IMO it is necessary to discuss whether we treat all drop messages as vulnerable to timing attacks or none.
Will a future module developer be able to implement an "auto-response" function? If so we need to care about the crypto functions which are used to handle the decryption/verification of such a message.

In addition to this we need to evaluate how exceptions for these functions are handled because they give a timing attack vector [1].
[1] http://www-brs.ub.ruhr-uni-bochum.de/netahtml/HSS/Diss/MeyerChristopher/diss.pdf

from qabel-core.

This is a rather old issue. What is the status of this @L-Henke and @roeslpa? If need be and reasonable use re-label, attach a milestone or assignee. Anyway an update in here would be nice.

from qabel-core.

This is a META issue to gather vulnerable components.

from qabel-core.

IMO this issue can be closed since this secure coding wiki exists, until now we cared about it and from now on everyone who writes critical code should read the wiki.
Any other thoughts about this? @L-Henke

from qabel-core.

I will create a PR which incorporates the wiki page into our contribution guidelines and then close this issue.

from qabel-core.

@thechauffeur are you okay with it if write it to the guidelines?

from qabel-core.

Automatically resolved by #424

from qabel-core.