Timeline for Correlation Power Analysis on AES - possible attack models
Current License: CC BY-SA 4.0
5 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Feb 22, 2022 at 1:35 | comment | added | kelalaka | There is one important problem here; normally you don't expect someone decrypts the ciphertext again and again. In a normal operation, you have one shot. To force the user/system to decrypt again one might need an additional fault attack or some other mechanism in the protocol... | |
| Feb 15, 2022 at 18:35 | comment | added | fgrieu♦ | @user100099: You are correct that there is a significant difference in round 14 and in round 13, and the answer now acknowledges that. Sorry, I won't go into the details of an actual CPA attack. Big picture of my point remains valid, I hope: once round 14 has been successfully attacked, we have the output of round 13 much like we have that for round 14 under known ciphertext attack, and we can hope to mount an (admittedly different) CPA attack on round 13. | |
| Feb 15, 2022 at 18:28 | history | edited | fgrieu♦ | CC BY-SA 4.0 |
Polish
|
| Feb 15, 2022 at 16:21 | comment | added | user100099 | knowing the last roundkey and ciphertext means I can inverse calculate the last round and end up with the input into the last sub byte operation. Before that there is the 13th round key addition phase, where the 14th subkey is xored with the output of mixcolumn of the rround before. how do we figure out the 14th subkey value, if we only know the output of the mixcolumns Xor key operation? | |
| Feb 15, 2022 at 15:45 | history | answered | fgrieu♦ | CC BY-SA 4.0 |