On Wed, Dec 05 2018, Coiner, John wrote: I forgot to mention this in my initial reply in <878t13zp8y.fsf@xxxxxxxxxxxxxxxxxxx>, but on a re-reading I re-spotted this: > - hashes are secret. If the hashes from a protected tree leak, the > data also leaks. No check on the server prevents it from handing out > contents for correctly-guessed hashes. This is a thing I know *way* less about so maybe I'm completely wrong, but even if we have all the rest of the things outlined in your post to support this, isn't this part going to be susceptible to timing attacks? We'll do more work if you send a SHA-1 during negotiation that shares a prefix with an existing SHA-1, since we need to binary search & compare further. SHA-1 is 160 bits which gives you a huge space of potential hashes, but not if I can try one bit at a time working from the start of the hash to work my way to a valid existing hash stored on the server. Of course that assumes a way to do this over the network, it'll be on AMD's internal network so much faster than average, but maybe this is completely implausible. NetSpectre was different and relied on executing code on the remote computer in a sandbox, not waiting for network roundtrips for each try, so maybe this would be a non-issue.
