Hot answers tagged timing-attacks
10
Generally speaking, a lookup-table can be implemented in constant time by doing it as if it was a hardware circuit.
Consider a multiplexer: this is a circuit which accepts three inputs a, b and c, and yields one output d which is equal to a if c = 0, to b otherwise (I am talking about single-bit values here). A multiplexer can be used to implement a 1→1 ...
9
Timing attacks rely on operations which do not always take the same time to execute, depending on the processed data. For instance, on a typical software platform (say, a PC) implementing SHA-256, all operations are 32-bit additions or rotations or bitwise combinations which take a constant time to execute, regardless of the actual operand values. SHA-256 is ...
7
The paper explains why. Preventing the OS from interrupting the AES computation is part of Bernstein's proposed method of defense against cache-based timing attacks. Let me sketch the argument for you:
The early part of the paper explains that if the time is variable, then it introduces a risk of timing attacks. Sections 3-6 demonstrate that such an ...
5
Just to complement Thomas's reply, here are a couple of papers that do not rely on SIMD registers to implement bitsliced AES:
How Far Can We Go on the x64 Processors? (source in appendix)
A Fast and Cache-Timing Resistant Implementation of the AES (source code)
4
Yes, timing attacks are relevant to real-world implementations of crypto. Yes, as that paper demonstrates, these attacks can be carried out in real life: real networks are fast enough to allow these attacks.
It is also important to understand that some network services do provide timestamps that leak information about how long the operation took on the ...
4
If an implementation uses a poor PRNG, there will always be vulnerabilities in that implementation. However, if you replace Random for a cryptographically secure PRNG, the method you describe for generating private exponents is fine. In such case the timings will only reveal information about:
The public modulus $p$, which may be presumed to be known ...
2
If I recall correctly the idea is to deduce key bits via the uneven S_BOX lookup timings.
Since the time for a lookup varies widly depending wether or not a given variable is in cache or not a solution might be to make sure to have all S_BOXes in cache for the entire computation. Unfortunately even if that was possible an interrupt could cause the cache to ...
1
Not something I have a real life example of, just an idea.
Certain computationally intensive tasks can be done much faster using memoization. Now if the compiler manages to automatically use memoization for some piece of code that code might run much faster than what the language notation suggests.
In C++, for example, any optimization is allowed as long ...
Only top voted, non community-wiki answers of a minimum length are eligible
