Tag Info

Yes, side-channel attacks are practical and a real concern, if the past is indicative of the future. I've been professionally involved with Smart Cards since the mid eighties, and have repeatedly witnessed deployed systems vulnerable to many forms of side-channel attacks; examples: RAM buffer not cleared at reset, readable (with standard command Get ...

The paper explains why. Preventing the OS from interrupting the AES computation is part of Bernstein's proposed method of defense against cache-based timing attacks. Let me sketch the argument for you: The early part of the paper explains that if the time is variable, then it introduces a risk of timing attacks. Sections 3-6 demonstrate that such an ...

I'm not sure which post you're referring to, but one possible source of leakage results from using a variable-bit rate codec. If different sounds compress at different rates, than this will be reflected in the lengths of outgoing encrypted packets. By examining those sequences of lengths, it can sometimes be possible to accurately guess what phrases are ...

Yes, timing attacks are relevant to real-world implementations of crypto. Yes, as that paper demonstrates, these attacks can be carried out in real life: real networks are fast enough to allow these attacks. It is also important to understand that some network services do provide timestamps that leak information about how long the operation took on the ...

So, when building a system which uses cryptography (be it public or symmetric key), how practical of a concern are such attacks? Any class of attacks becomes a practical concern the moment it starts to become attractive for an attacker with respect to other classes, and provided any successful attack brings rewards that outbalance the cost. That is true ...

Their attack does not recover the private key. Instead, it gives the attacker a way to decrypt an arbitrary ciphertext of the attacker's choosing. (This is not the same thing.) If the attacker has a ciphertext $c$, the attacker can query the hardware device tens of thousands of times and then based upon the responses, deduce what the decryption of $c$ is. ...

As @CodesInChaos explains: It might refer to blind signatures. It also might refer to a method to harden (typically) RSA implementations against timing/side-channel attacks, by blinding the data before operating on it. Example: suppose you are writing code to decrypt data, i.e., to compute $y=x^d \bmod n$, given the input $x$. The naive way to do is just ...

If I recall correctly the idea is to deduce key bits via the uneven S_BOX lookup timings. Since the time for a lookup varies widly depending wether or not a given variable is in cache or not a solution might be to make sure to have all S_BOXes in cache for the entire computation. Unfortunately even if that was possible an interrupt could cause the cache to ...

Efficient constant-time exponentiation algorithms exist. For example, one could calculate a sequence as follows: Given $a^{k}, a^{k+1}$ calculate either $a^{2k+2}, a^{2k+1}$ or $a^{2k}, a^{2k+1}$. Both calculations differ only in which value is squared and which is multiplied, making them easy to implement with a single conditional swap as the only ...

Timing attacks against a function $f_k$ generally require two things: The attacker might observe the target perform $f_k(x)$ for a large number of sufficiently diversified known inputs $x$. For each $k$, there are inputs $x$ and $x'$ such that $f_k(x)$ and $f_k(x')$ are expected to execute at different speed. Now, let's assume $f_k$ is the private key ...

I'm not sure what you mean by a "practical" concern. There are firms offering DPA testing services of PIN pads, so I'd say that yes, defending against DPA is a pragmatic decision. Researchers demonstrated openssl timing attacks that were very successful against other servers located in the same physical Amazon cloud server. Most successful crypto attacks ...