# Tag Info

12

I believe that it is for two reasons: Nontable based implementations of AES are possible, but (assuming you don't have AES-NI or something similar) are significantly slower than table based implementations (perhaps $10\times$ to $20\times$ slower) For a lot of uses, timing attacks aren't particularly relevant (as either the attacker can't get the ...

6

A cryptographical algorithm can't be immune or not immune to side channel attacks; this is because a side channel attack attacks the implementation and not the actual algorithm. Any algorithm that uses secret data can be implemented in a way that has side channel attacks, and any algorithm can be implemented in a way that may be resistant (the hard-core ...

5

No, because timing attacks don't really have anything to do with errors. A timing attack means analyzing the time it takes a cryptographic operation to complete leaks secret information. That actually has nothing to do with error messages; it's just as much a timing attack to look at how long it takes the server to decrypt something in a CTR mode (where the ...

3

It all comes down to your threat model, right? Just because an implementation is done in hardware does not mean that power and fault attacks must be considered. If I host the hardware in my secure facility with armed guards at the door, but the hardware is connected to a machine which is connected to the internet, I might feel that it is okay to not be ...

2

Q: How long shall the RSA key be in order to be secure against practical attacks? A: Impractically large. This does not imply that RSA is unsafe against practical attacks; only that some of these attacks must be prevented by ways other than increasing the key size. That's because key size is not a parameter with a major impact on the efficiency of many ...

2

Yes, string algorithms can be vulnerable to timing attacks. A very common example is string comparison. The best performing way to implement it in general is to compare two strings one character (or memory word) at a time and return inequality as soon as they don't match. However, this kind of a routine is vulnerable to timing attacks that can find the ...

2

Sure you can do. There are many lattice attacks, using your second assumption, to ECDSA (which also applied to DSA). For instance see Smart and Howgrave-Graham and Shparlinski and Nguyen. All the lattice attacks base on finding small solutions (for the ephemeral key $k$ and the private key $a$) to the signing equation $sk-ra\equiv H(m)\pmod q.$ If you have ...

2

Good blinding requires good randomness. Randomness is a hard requirement, especially for embedded systems. In a similar vein, the DSA and ECDSA signature algorithms require a strongly random integer (called k) for each signature, and several implementations have failed to use random enough values, with hilarious consequences; the most well-known case is Sony ...

1

Often people build hardware that contains cryptographic algorithms, and they are worried about what happens if that hardware falls into the hands of an attacker. Historically, there have been several approaches to making it harder for the attacker, often used in some combination: Hardware and cryptographic algorithms specifically chosen or designed to ...

1

For Q1, you could leak the key efficiently by using something like a fountain code (which are conceptually similar to secret sharing schemes). For example, you could map the key to the coefficients of a polynomial $p$ over a finite field $F$ (of suitable size), evaluate it at a random point $a \in F$ (or $a \in S$ for some subset $S \subset F$), and leak ...

1

As you say, if the measurements are accurate then the device can leak $log_2(n)$ bits of information on each invocation. If it lacks internal storage then it can't track which parts of the key it has already leaked. What it can do is leak a random set of bits, but the recipient has to know which bits they are. I see two approaches. If the timing channel ...

1

I am not familiar with your side channel attack "here", but it looks like what I have read about before in those that monitor the processor to determine calculations. "The trick is based on the fact that the “ground” electrical potential in many computers fluctuates according to the computation that is being performed by its processor—including the ...

1

Use Keylength.com There are several metrics that try to estimate for how many years a given keylength may last you. The length calculator at Keylength.com (http://www.keylength.com/en/compare/ ) uses eight such heuristics to give you a general idea which size you should choose. You can go both directions. You can either enter a year and receive a ...

1

You can begin by first reading the seminal paper of Paul Kocher. He gave the reference for Timing and Power analysis attacks. The best is to read the papers, and understand the philosophy of Side Chanel Attacks. The method he described, has been enhanced by many authors, and it become impossible to ignore how to securelly implement algorithm on embedded ...

1

The exact details depend on the logic family but basically The difference is that the charge representing those "1" bits need to be discarded somehow. This is done by switching the output to ground, 1^0 is 1 so no charge need to go away but 1^1 is zero meaning at least two gates get discharged to ground slightly raising its voltage due to the non zero ...

Only top voted, non community-wiki answers of a minimum length are eligible