Quick Project #2: Ruby Methods for Protecting Against Timing Attacks

Breaking with my usual style, Quick Project #2 doesn't necessarily relate to music programming.

Today I came across a nice little article and demo on r/compsci about timing attacks.

Timing attacks are something that I had learned about a few years ago but for whatever reason had dropped from the forefront of my engineering consciousness. In order to bash myself over the head with it (and provide a universal solution), I created Ruby wrapper methods for Object#send and block evaluation that are padded with a fixed timing delay.

Here 'tis, including some basic String comparison examples at the bottom:

https://gist.github.com/2554841

To use it, just pass in a "safe" duration (in seconds) that likely exceeds any possible amount of time it could take to evaluate the code. In the following example I use the greatly exaggerated value of .75 seconds. In the wild, you'll most likely be working in smaller durations

  is_match = ExpressionTimer.block(0.75) { "password attempt!" == "my password!" }

When the example is run, no matter how quickly the block actually evaluates, it will always take exactly 3/4s of a second to return. As a result, actual timing information is lost in the ether and can not be gleaned by any outside observer.

Topaz: MIDI syncable tempo in Ruby

Topaz is a Ruby based music tempo generator / analyzer 

gem install midi-topaz

It gives you the ability to time events to a given rate in beats per minute
("sequencer" is some kind of imagined sequencer)

@tempo = Topaz::Tempo.new(130) { sequencer.step! }

or synchronize them to incoming MIDI clock messages

@input = UniMIDI::Input.first.open # a midi input

@tempo = Topaz::Tempo.new(@input) { sequencer.step! }

Topaz can also act as a MIDI master clock.  If a MIDI output object is passed to Topaz, MIDI start/stop/clock signals will automatically be sent to that output at the appropriate time

@output = UniMIDI::Output.first.open # a midi output

@tempo = Topaz::Tempo.new(120, :midi => @output) { sequencer.step! }

an input can be used along with multiple outputs simultaneously

@tempo = Topaz::Tempo.new(@input, :midi => [@output1, @output2]) { sequencer.step! }

once everything is all set, start the clock

@tempo.start

Note that if you are syncing to external clock, nothing will happen until Topaz receives a start or clock message

Other stuff to note...

Whether or not you're using an internal or external clock source, the event block will be called at quarter note intervals by default. If you wish to change this, set the option :interval.  In this case, 16th notes will occur at 138 beats per minute where one beat equals one quarter note

@tempo = Topaz::Tempo.new(138, :interval => 16) { sequencer.step! }

View the current tempo, which is calculated by Topaz if you're syncing to an external source.
(this feature is in progress. you might receive some unreliable values - 5/26/2011)

@tempo.tempo
    => 132.422000

Run the generator in a background thread by passing :background => true to Tempo#start

@tempo.start(:background => true)

@tempo.join # join later if you want

Pass a block in that will stop the clock when it evaluates to true

@tempo.stop_when { @i.eql?(20) }

http://github.com/arirusso/topaz