Hot answers tagged

12

I believe that it is for two reasons: Nontable based implementations of AES are possible, but (assuming you don't have AES-NI or something similar) are significantly slower than table based implementations (perhaps $10\times$ to $20\times$ slower) For a lot of uses, timing attacks aren't particularly relevant (as either the attacker can't get the ...


7

A common method for constant-time comparison goes $r←0$ for each bit/byte/word $x_i$ and $y_i$ to compare $r←r ∨ (x_i⊕y_i)$   where $∨$ stands for bitwise OR and $⊕$ stands for bitwise XOR all the $x_i$ match the corresponding $y_i$ if and only if $r$ is now $0$ The point is that the duration is independent of the data compared, thus measuring ...


6

A cryptographical algorithm can't be immune or not immune to side channel attacks; this is because a side channel attack attacks the implementation and not the actual algorithm. Any algorithm that uses secret data can be implemented in a way that has side channel attacks, and any algorithm can be implemented in a way that may be resistant (the hard-core ...


5

No, because timing attacks don't really have anything to do with errors. A timing attack means analyzing the time it takes a cryptographic operation to complete leaks secret information. That actually has nothing to do with error messages; it's just as much a timing attack to look at how long it takes the server to decrypt something in a CTR mode (where the ...


4

Often people build hardware that contains cryptographic algorithms, and they are worried about what happens if that hardware falls into the hands of an attacker. Historically, there have been several approaches to making it harder for the attacker, often used in some combination: Hardware and cryptographic algorithms specifically chosen or designed to ...


3

Sure you can do. There are many lattice attacks, using your second assumption, to ECDSA (which also applied to DSA). For instance see Smart and Howgrave-Graham and Shparlinski and Nguyen. All the lattice attacks base on finding small solutions (for the ephemeral key $k$ and the private key $a$) to the signing equation $sk-ra\equiv H(m)\pmod q.$ If you have ...


2

Good blinding requires good randomness. Randomness is a hard requirement, especially for embedded systems. In a similar vein, the DSA and ECDSA signature algorithms require a strongly random integer (called k) for each signature, and several implementations have failed to use random enough values, with hilarious consequences; the most well-known case is Sony ...


2

Q: How long shall the RSA key be in order to be secure against practical attacks? A: Impractically large. This does not imply that RSA is unsafe against practical attacks; only that some of these attacks must be prevented by ways other than increasing the key size. That's because key size is not a parameter with a major impact on the efficiency of many ...


2

Yes, string algorithms can be vulnerable to timing attacks. A very common example is string comparison. The best performing way to implement it in general is to compare two strings one character (or memory word) at a time and return inequality as soon as they don't match. However, this kind of a routine is vulnerable to timing attacks that can find the ...


1

I am answering on the basis of this paper (pdf) linked in the comments, as well as some of the related papers it cites or is cited by. I am not aware of more realistic attacks on HMAC. It assumes a DPA side channel that leaks the number of bits flipped when a new value is read into a CPU register (or in another instruction in some of the papers). I.e. it ...


1

For Q1, you could leak the key efficiently by using something like a fountain code (which are conceptually similar to secret sharing schemes). For example, you could map the key to the coefficients of a polynomial $p$ over a finite field $F$ (of suitable size), evaluate it at a random point $a \in F$ (or $a \in S$ for some subset $S \subset F$), and leak ...


1

As you say, if the measurements are accurate then the device can leak $log_2(n)$ bits of information on each invocation. If it lacks internal storage then it can't track which parts of the key it has already leaked. What it can do is leak a random set of bits, but the recipient has to know which bits they are. I see two approaches. If the timing channel ...


1

I am not familiar with your side channel attack "here", but it looks like what I have read about before in those that monitor the processor to determine calculations. "The trick is based on the fact that the “ground” electrical potential in many computers fluctuates according to the computation that is being performed by its processor—including the ...


1

As you suggest, you can speedup the exponentiation using pre-computed values. However, you will face the following problems: the table with the precomputed values can become rather large, and the table lookup is in general not constant time. An example of how these problems can be addressed can be found in the Ed25519 implementation of Bernstein et al.; ...



Only top voted, non community-wiki answers of a minimum length are eligible