# Tag Info

8

In comparison against CBC mode and HMAC, GCM mode is quite commonly better alternative. But, I'll go to detail where it neccessarily is not. Just like Richie Frame, I also do not agree that CBC + HMAC is always the best comparison target. I've added few other details. Hope you find them useful. Against CBC and HMAC I'll discuss downsides first. The ...

5

Because the time that the Extended Euclidean algorithm depends on the inputs (and, in particular, is a complex function of the two, depending on the ratio expressed as a continguous fraction), there may be some leakage there. It occurs to me, however, that there is a very simple countermeasure; assuming that the secret modulus you are inverting is $p$, and ...

4

There are two papers on conventional differential cryptanalysis of SEED. The last one penetrates only half of the cipher. Even though there are few third-party cryptanalysis papers, there is no indication that the cipher is weak. Fault attacks are quite irrelevant in the SSL setting. I would be more concerned with BEAST-like attacks, as SEED is a ...

4

A fault injection attack is based on the fact that you have a healthy black box on which you can do queries, but you can mess with the black box, for example flipping random bits. In real life this could for example be a RFID chip which can be messed with using strong electronic fields. Attacks like these are generally: Very sophisticated in theory and ...

4

Power Analysis attacks rely on the attacker being able to analyse the power used by the computing device, so such attacks work best on platforms where the attacker can analyse the power drawn by the device with cycle accuracy. This points at smart cards, which: use an external source of power; have very little room for some isolation circuitry which would ...

4

How did they jump from the spectrogram showing the RSA exponentiation timings straight to the secret bits? Actually, they're jumping to secret bits; however those aren't the secret bits you're thinking of. The bits displayed above are not the actual bits of $p$ and $q$. Instead, those are the bits from the secret exponent; because GnuPG uses CRT (and ...

2

Here's the next step in the iteration, which should be easy to understand: Let's call the oracle on 2P and 4P: Answer (even,even) means, that $P<N/4$ (this is still easy: Otherwise either 2P or 4P would be greater than N). Answer (even,odd) means $N/4<P<N/2$. (odd,even) means $N/2<P<3N/4$ and (odd,odd) means $3/4N<P<N$. Actually, ...

2

Actually, those two algorithms are surprisingly close; I'll write both of them up to show how close they are. They both can be written as a combination of three substeps: A := Add( B, C ) This takes the two points B and C, and adds them together (I'll be writing things in additive notation; in RSA, with would be a modular multiplication) A := Double( B ...

2

I found a reference of a side-channel attack to modular inversion being performed: New Branch Prediction Vulnerabilities in OpenSSL and Necessary Software Countermeasures (Onur Acıic¸mez, Shay Gueron, and Jean-Pierre Seifert) February 7, 2007 The Main Result: Modular Inversion Via Binary Extended Euclidean Algorithm Succumbs to Simple Branch Prediction ...

2

There exists a case where developers implemented a new version of the GHASH algorithm that used the new PCLMULQDQ instruction found in Intel processors, and a bug in the implementation allowed message forgery. The code change appeared to improve the performance of AES-GCM on newer processors as well as processors with additional cores that do not support ...

1

The approach with which I solved the problem is indeed as @tylo suggested. Initially we know that the target plaintext $P$ is within the bounds $[0,N]$ where the lower bound $LB=0$ and the upper bound $UB=N$. Now we iterate the following algorithm $log_{2}N$ times to find P from the original intercepted ciphertext $C$ $C' = (2^{e}\mod N) * C$ if ...

Only top voted, non community-wiki answers of a minimum length are eligible