RE: Is there a hidden channel in Xauthentication?

[Klaus Frank <klausf () Pool Informatik RWTH-Aachen DE>]

Michael Wojcik wrote:

> In any case, it's easy enough to mask the time by using a hand-coded
> comparison loop that always compares all the bytes and sets a flag if any of
> them differ.

The flag would be set n times, where n is the number of matching bytes in the
two cookies... I'm afraid there is still a timing difference. An attempt to
mask the time differences can be found in gnuserv version 3.12, permitted().

Klaus Frank