# Tag Info

## Hot answers tagged side-channel-attacks

5

Because the time that the Extended Euclidean algorithm depends on the inputs (and, in particular, is a complex function of the two, depending on the ratio expressed as a continguous fraction), there may be some leakage there. It occurs to me, however, that there is a very simple countermeasure; assuming that the secret modulus you are inverting is $p$, and ...

4

How did they jump from the spectrogram showing the RSA exponentiation timings straight to the secret bits? Actually, they're jumping to secret bits; however those aren't the secret bits you're thinking of. The bits displayed above are not the actual bits of $p$ and $q$. Instead, those are the bits from the secret exponent; because GnuPG uses CRT (and ...

3

It all comes down to your threat model, right? Just because an implementation is done in hardware does not mean that power and fault attacks must be considered. If I host the hardware in my secure facility with armed guards at the door, but the hardware is connected to a machine which is connected to the internet, I might feel that it is okay to not be ...

2

Actually, those two algorithms are surprisingly close; I'll write both of them up to show how close they are. They both can be written as a combination of three substeps: A := Add( B, C ) This takes the two points B and C, and adds them together (I'll be writing things in additive notation; in RSA, with would be a modular multiplication) A := Double( B ...

2

I found a reference of a side-channel attack to modular inversion being performed: New Branch Prediction Vulnerabilities in OpenSSL and Necessary Software Countermeasures (Onur Acıic¸mez, Shay Gueron, and Jean-Pierre Seifert) February 7, 2007 The Main Result: Modular Inversion Via Binary Extended Euclidean Algorithm Succumbs to Simple Branch Prediction ...

Only top voted, non community-wiki answers of a minimum length are eligible