attacks using information leaked by implementations of cryptographic algorithms to obtain information about keys or (plaintext) data, instead of (or additional to) using cryptographic weaknesses.

learn more… | top users | synonyms

0
votes
0answers
27 views

How can a lattice attack be applied to ECDSA signatures?

The aim is to check if it is possible to break the ECDSA cryptosystem under the following criteria. Suppose that each ECDSA signature is generated by using the GLV method for point multiplication ...
0
votes
0answers
30 views

Side channel attack on FPGA AES engine

I actually don't know if this is the right place where ask, but I try. The side channel attacks aren't a negligible problem. There are several ways to protect from these attacks its own IP inside the ...
2
votes
1answer
85 views

Double-and-add/Montgomery VS blinding

I'm having a hard time understanding why people use constant-time techniques to counter time-attacks, when blinding seems as good and cheaper to implement. Why do people avoid blinding in ECC?
2
votes
0answers
55 views

DPA Attack on HMAC SHA-256

I have read the paper Differential Power Analysis of HMAC SHA-2 in the Hamming Weight Model and I want to understand the DPA Attack. In section 3.2.1 Path 1 (page 4) there is written: The last ...
5
votes
2answers
121 views

power consumption in a XOR

I'm trying to understand how a XOR affect traces of power consumption in a Differential Power Analysis on smartcards. What's the difference in energy radiated in a $1 \oplus 1$ and in a $0 \oplus 1$? ...
4
votes
1answer
729 views

What is “Blinding” used for in cryptography?

What does "blinding" mean in cryptography, and where do we usually use it? Can you describe a sample implementation?
2
votes
2answers
84 views

Is there a cryptographic algorithm which is immune to side channel attacks?

Is there any cryptographic algorithm immune to side channel attacks based on scan chain? In VLSI point of view.
3
votes
3answers
159 views

Attack against modular inversion operation using side-channels?

I'm building a device that performs a modular inversions using a secret modulus. I would like to know if it is possible to recover all or part of this modulus by side-channels (timing, power, EMR, ...
3
votes
2answers
151 views

Power analysis and exponentiation by squaring

I am trying to understand how one can retrieve the secret exponent via a simple power analysis. Lets suppose that the exponentiation by squaring algorithm is implemented in its simplest form : ...
8
votes
2answers
107 views

Information-theoretic bound on leakage by timing measurement

I'm looking for an information-theoretic bound on leakage by timing measurement. I'm assuming that an attacker wants to leak out of a black box a secret key of $k$ bits that is secretly injected ...
0
votes
0answers
55 views

side channel attacks against TDES (compared to AES)

We all know AES has some pretty strong side channel attacks, some where (with a couple of hundred know plain- and ciphertext combinations) a key can be derived in a matter of minutes. Others may take ...
0
votes
2answers
315 views

Practical Attack on RSA

Currently I am designing an RSA based application, and I am thinking of how long should the key be in order to be secure against attacks. I know that RSA 4096 bit key can be recovered using Sound ...
1
vote
1answer
97 views

Defence against timing attacks

I know this is a difficult subject but would a good defense against timing attacks be not sending a message if the decryption or authentication fails? So if the attacker provides a wrong HMAC for ...
4
votes
1answer
118 views

How did the power measurements translate to AES Key?

A side channel attack is described here. I did not quite get , how the power measurements are used to get the decryption key , can any body explain it?
1
vote
1answer
109 views

Protection of Elliptic Curve Implementations against side-channel attacks [closed]

Recent fast elliptic curve implementations, for example a presentation at Eurocrypt 2014 (earlier presentation slides, the paper) talks about protection against only timing attacks. Why only timing ...
0
votes
0answers
80 views

side channel attacks on AES

Say you have a web application that's performing AES encryption. What sorts of side channel attacks should one keep an eye out for? Timing attacks affect RSA more than symmetric ciphers in-so-far as ...
5
votes
1answer
128 views

Understanding Genkin-Pipman-Tromer's ground potential, side channel attack on RSA

I'm pretty sure that by now folks might have come across this research from Genkin-Pipman-Tromer (GPT) on extracting the RSA key used by GnuPG (GPG) just by measuring the ground potential. I'm going ...
0
votes
0answers
80 views

Where can I find source code of a compiler that secures a circuit (or attemps to)? [closed]

In the paper “Multiparty Computation Secure Against Continual Memory Leakage”, on page 1239 under section “Using an LDS Compiler Instead of OCL Compiler”, the authors discuss why they decided to use ...
2
votes
1answer
561 views

Montgomery Ladder vs Double-and-Add

I would like to know what (if any) are the advantages of using Montgomery Power ladder over the Double-and-Add-Always algorithm. I think that firstly, Monty would be slightly faster than DoubleAndAdd. ...
6
votes
2answers
299 views

Cryptanalysis and weaknesses of SEED cipher

I've discovered that a client has SEED enabled in their SSL ciphers, and would like to know a bit more about it from a security perspective. The Wikipedia article doesn't mention any flaws, yet I've ...
3
votes
2answers
275 views

Information leakage in real-time voice encryption

I saw some time ago a post discussing the issues surrounding encryption of speech/voice in VoIP and how it can leak information (can't find it now). Can someone provide an insight into some of the ...
2
votes
1answer
174 views

Which platforms are most vulnerable to Simple Power Analyse Attack

In a "Simple Power Analyse Attack", the difference in power consumption during multiply or square operation is used. In the RSA decryption process with the "Square and Multiply" algorithm, both ...
2
votes
1answer
93 views

/dev/random only needed for key generation / CPU pattern encryption

Consider the following scenarios: using OpenSSL to encrypt a file with Rijndael-256 using LUKS to encrypt a hard-drive that is used every day Exactly when is entropy from ...
3
votes
2answers
477 views

Timing attack on modular exponentiation

It is known that computing $a^x \bmod N$ takes $O(|x| + \mathrm{pop}(x))$ multiplications modulo $N$, where $|x|$ is the number of bits of $x$ and $\mathrm{pop}(x)$ is the number of $1$ bits (Hamming ...
4
votes
2answers
628 views

RSA least significant bit oracle attack

I have been reading up on RSA attacks and came across one that could be called a least-significant-bit (LSB) oracle attack. For the sake of clarity lets define RSA primes $(p, q)$, private key $d$ ...
1
vote
0answers
134 views

How many messages needs to be send to server to get AES key in Cache-timing Attack

I'm trying to evaluate the correlation between key length and the number of messages that needs to be send to server during Cache timing Attack. I read both D. Bernstein, “Cache-timing attacks on ...
9
votes
2answers
3k views

Practical disadvantages of GCM mode encryption

It seems that GCM mode encryption has a clear advantage over CBC + HMAC in the sense that it only requires a single key. But it seems that there are some experts here that do not trust it enough to ...
9
votes
3answers
480 views

Should I delete cryptographic data from memory?

When dealing with cryptographic data, is there a chance that attacker recovers portion of data I used in my program? Should I try to delete every bit of keys and encrypted data that I used, overwrite ...
3
votes
1answer
798 views

Extract private RSA key from USB cryptographic token using Bardou et al. attack (variant of “million message attack”)

There is a side channel attack on tamper-resistant USB cryptographic tokens using padding-oracle, described by Bardou, Focardi, Kawamoto, Simionato, Steel and Tsay, titled "Efficient padding oracle ...
13
votes
3answers
2k views

How practical are side-channel attacks and how much of a concern are they?

I see a lot of research in very sophisticated side-channel attacks on crypto systems. Most (but definitely not all) seem to follow a trend, namely, the crypto system does something very dumb like ...
3
votes
2answers
568 views

Stopping timing attacks on AES: Why is it important to prevent the OS from interrupting the AES computation?

I read the paper Cache-timing attacks on AES (by Daniel J. Bernstein), but I don't seem to understand everything. The author dedicates a long section on how to prevent the OS to interrupt an AES ...
4
votes
1answer
913 views

AES timing attacks

I'm just interested in cryptography, so please don't expect me to be an expert. ;) I recently read about AES cache timing attacks and found it very interesting. I read the article Cache-timing attacks ...
7
votes
1answer
179 views

Are more complex algorithms easier to break with timing attacks?

Is there a point where increasing the complexity of an encryption algorithm will make it easier to break using a timing attack? Or is there no connection here at all?
12
votes
3answers
2k views

Known methods for constant time (table-free) AES implementation using 'standard' operations?

There are several known methods for implementing AES in constant time using SIMD operations, mostly based around fast byte shuffling (for instance Hamburg and Kasper/Schwabe). Are there any similar ...