Suppose that one performs (for example) AES-GCM encryption and decryption using an algorithm that is vulnerable to timing attacks, but each key is used only once. Is it still possible to perform a successful timing attack?
$\begingroup$
$\endgroup$
4
-
$\begingroup$ You ask about AES-GCM specifically but you use a theoretical "algorithm that is vulnerable to timing attacks". Can you clarify if you are more interested in AES-GCM or just timing attacks in general? $\endgroup$– d1str0Feb 24, 2016 at 23:38
-
2$\begingroup$ Every block uses the same key, so if you encrypt 1 message, with 1000 blocks, you can leak more than enough subkey material to recover the complete key $\endgroup$– Richie FrameFeb 25, 2016 at 0:54
-
$\begingroup$ @RichieFrame in AES-GCM, to be specific, each block is encrypted with a slightly different key because of the counter. Thus, if more than one block of plaintext are the same, they produce different cipher text blocks. So, really, the key isn't being used for each block directly. $\endgroup$– d1str0Feb 25, 2016 at 4:08
-
2$\begingroup$ @d1str0 each block does in fact use the exact same key, the counter is the plaintext input $\endgroup$– Richie FrameFeb 25, 2016 at 6:56
Add a comment
|
1 Answer
$\begingroup$
$\endgroup$
Yes.
Let's a thought experiment and not limit this to AES-GCM.
A very trivial example:
$M = \{0, 1\}$ (a one bit message)
$K = \{0, 1\}$ (a one bit key)
$E(m, k) = m \oplus k$
Let's say with this implementation the computation takes 100x as long if $k = 1$. Running this function only one time will give you a pretty good idea what k is based on how long it takes.
Again, this is just a trivial example meant for a thought experiment as to why you wouldn't necessarily need the encryption process to go more than once.
Another case might be that the plaintext has a series of repeated texts. All of which will be computed against the same key. This can be (not always) similar to computing a single plain text several times.
