Re: [webkit-dev] Timing attacks on CSS Shaders (was Re: Security problems with CSS shaders)

2011-12-08 Thread Rik Cabanier
This might no longer be true, but isn't it the case that shaders are designed to take the same amount of time to execute, no matter what input they get? ie if you have an if/else block, the time of the shader would be whatever block takes the longest. This was done so you can schedule many of them

Re: [webkit-dev] Timing attacks on CSS Shaders (was Re: Security problems with CSS shaders)

2011-12-08 Thread Oliver Hunt
On Dec 8, 2011, at 1:25 PM, Rik Cabanier wrote: This might no longer be true, but isn't it the case that shaders are designed to take the same amount of time to execute, no matter what input they get? ie if you have an if/else block, the time of the shader would be whatever block takes the

Re: [webkit-dev] Timing attacks on CSS Shaders (was Re: Security problems with CSS shaders)

2011-12-08 Thread Adam Barth
On Thu, Dec 8, 2011 at 1:25 PM, Rik Cabanier caban...@gmail.com wrote: This might no longer be true, but isn't it the case that shaders are designed to take the same amount of time to execute, no matter what input they get? ie if you have an if/else block, the time of the shader would be

Re: [webkit-dev] Timing attacks on CSS Shaders (was Re: Security problems with CSS shaders)

2011-12-05 Thread Chris Marrin
On Dec 3, 2011, at 11:57 PM, Adam Barth wrote: On Sat, Dec 3, 2011 at 11:37 PM, Dean Jackson d...@apple.com wrote: On 04/12/2011, at 6:06 PM, Adam Barth wrote: On Mon, Oct 24, 2011 at 9:51 PM, Adam Barth aba...@webkit.org wrote: Personally, I don't believe it's possible to implement this

Re: [webkit-dev] Timing attacks on CSS Shaders (was Re: Security problems with CSS shaders)

2011-12-05 Thread Adam Barth
On Mon, Dec 5, 2011 at 10:53 AM, Chris Marrin cmar...@apple.com wrote: To be clear, it's not the difference between white and black pixels, it's the difference between pixels with transparency and those without. Can you explain why the attack is limited to distinguishing between black and

Re: [webkit-dev] Timing attacks on CSS Shaders (was Re: Security problems with CSS shaders)

2011-12-05 Thread Chris Marrin
On Dec 5, 2011, at 11:32 AM, Adam Barth wrote: On Mon, Dec 5, 2011 at 10:53 AM, Chris Marrin cmar...@apple.com wrote: To be clear, it's not the difference between white and black pixels, it's the difference between pixels with transparency and those without. Can you explain why the attack

Re: [webkit-dev] Timing attacks on CSS Shaders (was Re: Security problems with CSS shaders)

2011-12-05 Thread Charles Pritchard
On 12/5/11 3:34 PM, Chris Marrin wrote: On Dec 5, 2011, at 11:32 AM, Adam Barth wrote: On Mon, Dec 5, 2011 at 10:53 AM, Chris Marrincmar...@apple.com wrote: To be clear, it's not the difference between white and black pixels, it's the difference between pixels with transparency and those

Re: [webkit-dev] Timing attacks on CSS Shaders (was Re: Security problems with CSS shaders)

2011-12-04 Thread Adam Barth
On a personal note, Dean, please don't feel like I'm singling you or your colleagues out.  More or less this exact feature request has come up internally within Google at least three separate times. I'm telling you now exactly what I told those folks then.  (Although I did do some more research

Re: [webkit-dev] Timing attacks on CSS Shaders (was Re: Security problems with CSS shaders)

2011-12-04 Thread Charles Pritchard
On 12/3/11 11:06 PM, Adam Barth wrote: On Mon, Oct 24, 2011 at 9:51 PM, Adam Barthaba...@webkit.org wrote: Personally, I don't believe it's possible to implement this feature securely, at least not using the approach prototyped by Adobe. However, I would love to be proven wrong because this is

[webkit-dev] Timing attacks on CSS Shaders (was Re: Security problems with CSS shaders)

2011-12-03 Thread Adam Barth
On Mon, Oct 24, 2011 at 9:51 PM, Adam Barth aba...@webkit.org wrote: Personally, I don't believe it's possible to implement this feature securely, at least not using the approach prototyped by Adobe. However, I would love to be proven wrong because this is certainly a powerful primitive with

Re: [webkit-dev] Timing attacks on CSS Shaders (was Re: Security problems with CSS shaders)

2011-12-03 Thread Dean Jackson
On 04/12/2011, at 6:06 PM, Adam Barth wrote: On Mon, Oct 24, 2011 at 9:51 PM, Adam Barth aba...@webkit.org wrote: Personally, I don't believe it's possible to implement this feature securely, at least not using the approach prototyped by Adobe. However, I would love to be proven wrong

Re: [webkit-dev] Timing attacks on CSS Shaders (was Re: Security problems with CSS shaders)

2011-12-03 Thread Adam Barth
On Sat, Dec 3, 2011 at 11:37 PM, Dean Jackson d...@apple.com wrote: On 04/12/2011, at 6:06 PM, Adam Barth wrote: On Mon, Oct 24, 2011 at 9:51 PM, Adam Barth aba...@webkit.org wrote: Personally, I don't believe it's possible to implement this feature securely, at least not using the approach