Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Say you have a web application that's performing AES encryption. What sorts of side channel attacks should one keep an eye out for?

Timing attacks affect RSA more than symmetric ciphers in-so-far as I know.

Any ideas?

share|improve this question
This section on Wiki describes all side-channel attacks I know of (mostly cache timing and fault injection). But all of them kinda require the ability to run a program on the same machine or otherwise have some control over the machine (e.g. for fault injection). But if this is relevant to you, depends on your application/server. Some speculation: There was some nifty side-channel attack based on an RSA implementation based on the noise of the processor. Maybe no one has looked into that for AES ;) – tylo Oct 7 '14 at 15:54

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.