Recent fast elliptic curve implementations, for example a presentation at Eurocrypt 2014 (earlier presentation slides, the paper) talks about protection against only timing attacks. Why only timing attacks?

If these methods are implemented in hardware then I think it should have been protected against power attack and fault attack also.


closed as unclear what you're asking by CodesInChaos, DrLecter, poncho, e-sushi, Gilles Oct 23 '14 at 13:39

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 1
    $\begingroup$ Some people care about software implementations and talk about the relevant performance and side channels, other people care about hardware implementations and talk about the relevant performance and side channels. The linked talk falls in the software category. $\endgroup$ – CodesInChaos Oct 20 '14 at 15:21
  • $\begingroup$ @CodesInChaos You are probably right, but does it invalidate the question enough to close it? $\endgroup$ – Maarten Bodewes Oct 20 '14 at 22:18

It all comes down to your threat model, right? Just because an implementation is done in hardware does not mean that power and fault attacks must be considered. If I host the hardware in my secure facility with armed guards at the door, but the hardware is connected to a machine which is connected to the internet, I might feel that it is okay to not be concerned about power and fault injection attacks. On the other hand, if my hardware is being deployed "behind enemy lines" where it could be captured, you better believe that I should be worried about those sorts of attacks.


Not the answer you're looking for? Browse other questions tagged or ask your own question.