What are the reasons because of which ChaCha20 is immune to timing attacks ? Also why is not AES immune to timing attacks?

  • 1
    $\begingroup$ Timing attacks are often the result from poor implementation. AES is sound mathematically, but it is often used with lookup tables which can lead to variations in lookup times. $\endgroup$ – Azarinak Feb 23 '16 at 19:30
  • 2
    $\begingroup$ I'm not sure 'immune' is the right word to use here - It would probably be very easy to come up with some implementation of ChaCha20 that was trivially vulnerable to such attacks. $\endgroup$ – pg1989 Feb 23 '16 at 21:34

The obvious way of implementing ChaCha20 involves nothing but additions, fixed rotations, and XORs. All of these are constant time, so the obvious way of implementing ChaCha20 is secure against timing attacks. The main way that ChaCha20 is made faster -- SIMD -- does not change this.

On the other hand, the obvious way of implementing AES uses table lookups for the S-boxes. These are not constant time because of caching. Avoiding this requires either:

  • Naive approaches with massive performance penalties.
  • A technique called bitslicing. This uses the unlimited parallelism available in CTR mode to emulate a hardware AES implementation, but operating on many bits in parallel. This only works in CTR mode (because other modes don't have the requisite parallelism) and is not easy to implement.
  • 1
    $\begingroup$ Addition is not necessarily constant time, but most adders (especially those used in general-purpose processors and even MCUs) are indeed constant time. $\endgroup$ – forest Apr 27 at 6:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.