# Tag Info

13

The book Cryptography Engineering devotes part of a chapter to this topic. Overwriting sensitive data with zeroes is a good start, but there are lots of other considerations. If you rely on a language's default object destruction behavior to zero the memory, it's possible for an unexpected error to prematurely halt the program's execution without it ...

4

Their attack does not recover the private key. Instead, it gives the attacker a way to decrypt an arbitrary ciphertext of the attacker's choosing. (This is not the same thing.) If the attacker has a ciphertext $c$, the attacker can query the hardware device tens of thousands of times and then based upon the responses, deduce what the decryption of $c$ is. ...

3

Timing attacks against a function $f_k$ generally require two things: The attacker might observe the target perform $f_k(x)$ for a large number of sufficiently diversified known inputs $x$. For each $k$, there are inputs $x$ and $x'$ such that $f_k(x)$ and $f_k(x')$ are expected to execute at different speed. Now, let's assume $f_k$ is the private key ...

3

As @CodesInChaos explains: It might refer to blind signatures. It also might refer to a method to harden (typically) RSA implementations against timing/side-channel attacks, by blinding the data before operating on it. Example: suppose you are writing code to decrypt data, i.e., to compute $y=x^d \bmod n$, given the input $x$. The naive way to do is just ...

3

In comparison against CBC mode and HMAC, GCM mode is quite commonly better alternative. But, I'll go to detail where it neccessarily is not. Just like Richie Frame, I also do not agree that CBC + HMAC is always the best comparison target. I've added few other details. Hope you find them useful. Against CBC and HMAC I'll discuss downsides first. The ...

2

This question is actually not entirely easy to answer. Usually, adding complexity to a cryptographic scheme or implementation, should be avoided, unless the added complexity is necessary in order to meet a specific requirement. The problem with software that is zeroing internal memory, is just that it is hard to come up with a credible scenario, where this ...

2

Yes, it's a good idea. But unfortunatelly it's far from trivial to securely wipe data from memory. Modern compilers, operating system and CPUs make it really, really hard. For instance you never know where your computer has stored sensitive data. CPUs have L1, L2 and shared L3 caches. NUMA (even ccNUMA) can do fancy stuff with your data until you enforce a ...

2

Here's the next step in the iteration, which should be easy to understand: Let's call the oracle on 2P and 4P: Answer (even,even) means, that $P<N/4$ (this is still easy: Otherwise either 2P or 4P would be greater than N). Answer (even,odd) means $N/4<P<N/2$. (odd,even) means $N/2<P<3N/4$ and (odd,odd) means $3/4N<P<N$. Actually, ...

1

The approach with which I solved the problem is indeed as @tylo suggested. Initially we know that the target plaintext $P$ is within the bounds $[0,N]$ where the lower bound $LB=0$ and the upper bound $UB=N$. Now we iterate the following algorithm $log_{2}N$ times to find P from the original intercepted ciphertext $C$ $C' = (2^{e}\mod N) * C$ if ...

1

There exists a case where developers implemented a new version of the GHASH algorithm that used the new PCLMULQDQ instruction found in Intel processors, and a bug in the implementation allowed message forgery. The code change appeared to improve the performance of AES-GCM on newer processors as well as processors with additional cores that do not support ...

1

Efficient constant-time exponentiation algorithms exist. For example, one could calculate a sequence as follows: Given $a^{k}, a^{k+1}$ calculate either $a^{2k+2}, a^{2k+1}$ or $a^{2k}, a^{2k+1}$. Both calculations differ only in which value is squared and which is multiplied, making them easy to implement with a single conditional swap as the only ...

Only top voted, non community-wiki answers of a minimum length are eligible