I do have the sentence "This difference is enough to measure, even on web applications." in the fourth paragraph. Should I highlight that a bit, bold maybe?
I'd also like a good reference for that, and my Google skills were failing me. Do you happen to have a link to something show that off?
I missed that on the first read-through. Invariably when you introduce someone smart to timing attacks they will say "Oh, but that's not going to be practical over TCP/IP.
Comments
I do have the sentence "This difference is enough to measure, even on web applications." in the fourth paragraph. Should I highlight that a bit, bold maybe?
I'd also like a good reference for that, and my Google skills were failing me. Do you happen to have a link to something show that off?
http://www.cs.rice.edu/~dwallach/pub/crosby-timing2009.pdf
Awesome, thanks!
http://crypto.stanford.edu/~dabo/papers/ssl-timing.pdf
Awesome, thanks! Added this and the other one to the post.
I missed that on the first read-through. Invariably when you introduce someone smart to timing attacks they will say "Oh, but that's not going to be practical over TCP/IP.