[time-nuts] Time stamp degradation being added in javascript

Magnus Danielson magnus at rubidium.dyndns.org
Fri Jan 12 18:11:07 EST 2018


These bugs is a big deal. I even had to answer customer questions on them.

Interesting how you can use the cycle counter to deduct information out
of that channel, forming a side-channel.

Adding random jitter only slows down the attack, as the average bias
difference won't change.

Cheers,
Magnus

On 01/07/2018 03:53 PM, David J Taylor via time-nuts wrote:
> From: David
> 
> Possibly not of immediate concern to time-nuts but an article had some
> trigger words for them in the initial fixes to the much publicised
> problems with Intel/AMD/ARM etc :
> 
> "After these changes, the time stamp returned by |performance.now| will
> be less precise due to lower resolution. Some browsers are going a step
> further and degrade the accuracy by adding a random jitter."
> 
> https://hackaday.com/2018/01/06/lowering-javascript-timer-resolution-thwarts-meltdown-and-spectre/
> 
> 
> meltdown/spectre background
> https://www.theregister.co.uk/2018/01/04/intel_amd_arm_cpu_vulnerability/
> ================================
> 
> David,
> 
> This API appears only to affect browsers.
> 
> On my Windows systems most have been patched, and I see no visible
> difference on either PPS-synced, LAN-synched or Wi-Fi devices as
> recorded by NTP.  One PC showed an increase in CPU usage, but other PCs
> performing similar tasks have not.  That same PC showed a doubling of
> jitter from less than 2 microseconds to less than 4 microseconds.  It's
> an i5-4460 Haswell processor.
> 
>  http://www.satsignal.eu/mrtg/harstad-cpu-week.png
> 
> Cheers,
> David


More information about the time-nuts mailing list