3
$\begingroup$

I recently was engaged in a discussion in Sec.SE where somebody used the term "sidechannel" to actually mean "circumvent the encryption".

By what he said it was clear, that he wanted to not bother with crypto at all and this is - in my view - not a sidechannel. However, rubberhose cryptanalysis was also mentioned and it was argued that rubberhose cryptanalysis is a sidechannel because the definition of sidechannel includes the physical implementation of the cryptosystem and the human is part of the physical implementation.

So ultimately my question:
Can rubberhose cryptanalysis formally be considered a sidechannel?


The definition of sidechannel quoted in this context:

In cryptography, a side-channel attack is any attack based on information gained from the physical implementation of a cryptosystem, rather than brute force or theoretical weaknesses in the algorithms (compare cryptanalysis).

I've also seen Wikipedia:

Attempts to break a cryptosystem by deceiving or coercing people with legitimate access are not typically called side-channel attacks

But I'm asking if it is allowed by the definition of sidechannel attacks to include rubberhose cryptanalysis.

$\endgroup$
  • 1
    $\begingroup$ At least in literature, I have never seen anyone include rubberhose cryptanalysis as a side-channel. $\endgroup$ – Aleph Mar 6 '16 at 14:40
  • 1
    $\begingroup$ Well, the definition you give is not a formal one, so I don't think it's possible to tell whether something is or is not formally a side-channel attack according to it. $\endgroup$ – fkraiem Mar 6 '16 at 15:31
  • $\begingroup$ Rubberhose cryptanalysis could be seen as a side-channel, yes, but you couldn't say that you are attacking a specific cryptosystem (e.g., AES) or implementation. $\endgroup$ – cygnusv Mar 7 '16 at 9:59
1
$\begingroup$

Yes. A human surely is a physical component of the cryptosystem. Even if we ignore the "physical" aspect, we have

implementation of a cryptosystem, other than brute force or theoretical weaknesses in the algorithms.

If a key is not secure (ie. in the mind of a human who can be persuaded to divulge it), acquiring this password and bypassing the crypto would be a side-channel attack IMO.

|improve this answer|||||
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.