Questions about indexing a hash output to compose a final key

Question

Recently I have watched the video Multi-Precision Arithmetic for Cryptology in C++, at Run-Time and at Compile-Time (at 21:56 seg) :

The speaker says that to use a byte from the user key as a subscript of an array allows side channel attacks. My question is what if to use this during a key crunching stage:

Do

   HashOut = DoHash()

   FinalKey += HashOut[currentKeyByte mod KeySize]

   currentKeySize += 1

While (Len(FinalKey) < WantedSized);

Let's forget for a minute the widely known KDFs, okay? The idea behind the pseudo-code above would interfere in constant-time aspects?

If it does. What if to use the bytes from hashed key instead of the original bytes of the key?

Thanks in advance!

Answer 1

The speaker says that to use a byte from the user key as a subscript of an array allows side channel attacks.

Using secret data (be it the user key, the actual secret key or internal key or secret-dependent data of the crypto routine) can, depending on what you're doing and what sort of access the attacker has to your machine while you're working with the key.

My question is what if to use this during a key crunching stage

FinalKey += HashOut[currentKeyByte mod KeySize]

It depends on what currentKeyByte is (your pseudocode doesn't specify it).

If it's an index that iterates between 0 and WantedSize in a predictable fashion, then that's not an issue. The attacker could potentially deduce information of what currentKeyByte is; on the other hand, if he knows that this is iteration 5, he already knows that currentKeyByte is 4, and so any further information he gets from the side channel doesn't tell him anything he doesn't already know. Now, if that's the case, then this code would wrap around if KeySize < WantedSize; that's might not be what you want to do, but that's an unrelated issue.

On the other hand, if currentKeyByte is, in fact, a byte from the user's password, well, yes, that can be an issue (if the attacker can plausibly run a program on the same computer while the above code is running); if I were you, I'd rethink this, and rework this code.