We're waiting to see Microsoft's response to the paper, but some sources indicate that the attack will require stack traces be returned to a malicious party as a prerequisite for exploit. It is not yet known if there are more dangerous timing attacks that might yield, statistically, similar results over a larger number of requests. This is also not an attack on AES, but rather on the .NET implementation of AES (and possibly limited only to ASP.NET’s error handling). We do utilise AES to encrypt our cookies, so we're watching this with interest - it's likely if the error is validated that it will require a Microsoft patch to fix it.

---

Buy the new Professional DNN7: Open Source .NET CMS Platform book Amazon US

It seems a real threat - http://weblogs.asp.net/scottgu/archiv...

---

Best wishes,
- Richard
Agile Development Consultant, Practitioner, and Trainer
www.dynamisys.co.uk