6
$\begingroup$

There is generally a push to make algorithms and components constant time to be resistance to side channel attacks. For instance, AES-NI instructions take as many cycles as rounds; however, I can lower the CPU voltage and increase the clock speed until I see errors on the result. The circuits are only constant time if they satisfy the critical path propagation between latch boundaries.

When I read a paper that specifically says that it robust to side channel attacks because the algorithm is constant time, is the assumption that one does not have clock/voltage control?

To elaborate a bit on the boundaries that I mention, consider the following image that represents a pipeline of logic: Logic cloud In the image, there is a logic cloud that is operating on n-bits of information with a result. This is much like what a multiplicative inversion module looks like in hardware where you load the starting value and you then "latch" the result. The fundamental idea is that the clock line, CLK, is slow enough that you satisfy the worst-case propagation condition electrically. If I decrease the process voltage, and keep the clock the same speed, I can violate the path requirements. If I increase the clock speed for the same voltage, I also violate the requirements electrically.

Improve this question
$\endgroup$
7
  • 1
    $\begingroup$ It's only about software side channels, not hardware side channels $\endgroup$
    – CodesInChaos
    Commented Nov 25, 2017 at 17:28
  • $\begingroup$ Can you elaborate a little on "critical path propagation between latch boundaries" $\endgroup$
    – Q-Club
    Commented Nov 25, 2017 at 18:32
  • $\begingroup$ @back_seat_driver I put in an image. $\endgroup$
    – b degnan
    Commented Nov 25, 2017 at 18:57
  • 1
    $\begingroup$ @back_seat_driver In hardware design you have latches which are the default storage over multiple clock cycles. A critical path in a combinatorial circuit is the path through the gates with the longes delay. Thus if your propagation delay on your critical path is longer than a cycle, the value may not arrive during the current cycle at the storage. $\endgroup$
    – SEJPM
    Commented Nov 25, 2017 at 19:59
  • 1
    $\begingroup$ @back_seat_driver normally with flip-flops, data is stored on a clock edge, ie on a low-to-high voltage change of the clock input. Shortly after this point in time the output of the flip-flop has the stored value at which point the subsequent combinatorial logic gates (AND, OR, NOT, ...) start propagating the result of the new signal(s). Then at the next low-to-high clock edge, the current data at the latch's input is "written". If this happens before the data could propagate through the logic your overall expected clock count for the computation will be off. $\endgroup$
    – SEJPM
    Commented Nov 25, 2017 at 23:06

1 Answer 1

Reset to default
3
$\begingroup$

When I read a paper that specifically says that it robust to side channel attacks because the algorithm is constant time, is the assumption that one does not have clock/voltage control?

Generally, when we mention side channel without context, we actually mean a side channel in software. I.e. an adversary has (only) the ability to run code on the same CPU. Moreover, the adversary does not have physical access to the executing CPU.

In your case—underclocking the CPU and screwing around with the power supply—you are manipulating the CPU itself. In my book this would be considered a fault attack, which is a technique in hardware side channel analysis. Hardware side channel analysis is super-powerful, and because so much is possible it has a less obvious defined attacker model.

So it kinda depends on the context. Most of the time the literature will be about software side channels (time, cache, etc.). But when you are reading a CHES paper, it's probably about hardware.

Improve this answer
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.