What are the reasons because of which ChaCha20 is immune to timing attacks ? Also why is not AES immune to timing attacks?
$\begingroup$
$\endgroup$
3
asked Feb 23, 2016 at 17:48
-
2$\begingroup$ Timing attacks are often the result from poor implementation. AES is sound mathematically, but it is often used with lookup tables which can lead to variations in lookup times. $\endgroup$– AzarinakCommented Feb 23, 2016 at 19:30
-
3$\begingroup$ I'm not sure 'immune' is the right word to use here - It would probably be very easy to come up with some implementation of ChaCha20 that was trivially vulnerable to such attacks. $\endgroup$– pg1989Commented Feb 23, 2016 at 21:34
-
$\begingroup$ @pg1989 That is (trivially) true, but one generally must go out of one’s way to do so. $\endgroup$– DemiCommented Jul 20, 2019 at 0:13
Add a comment
|
1 Answer
$\begingroup$
$\endgroup$
1
The obvious way of implementing ChaCha20 involves nothing but additions, fixed rotations, and XORs. All of these are constant time, so the obvious way of implementing ChaCha20 is secure against timing attacks. The main way that ChaCha20 is made faster -- SIMD -- does not change this.
On the other hand, the obvious way of implementing AES uses table lookups for the S-boxes. These are not constant time because of caching. Avoiding this requires either:
- Naive approaches with massive performance penalties.
- A technique called bitslicing. This uses the unlimited parallelism available in CTR mode to emulate a hardware AES implementation, but operating on many bits in parallel. This only works in CTR mode (because other modes don't have the requisite parallelism) and is not easy to implement.
-
1$\begingroup$ Addition is not necessarily constant time, but most adders (especially those used in general-purpose processors and even MCUs) are indeed constant time. $\endgroup$– forestCommented Apr 27, 2019 at 6:25