2
$\begingroup$

So lets say the government has set their top priority to cracking a Veracrypt or Lukes or whatever volume containing highly confidential information. It uses AES or AES(Twofish). How would they start an attack and how efficient would it be?

Ps: If most block ciphers really are so vulnerable to side channel attack why are most governments still using them for classified information?

Improve this question
$\endgroup$
0

1 Answer 1

Reset to default
10
$\begingroup$

Obligatory XKCD: coercion (or/and bribery) works. Other usual strategies are

  • Rigging the particular machine used by the data owner.
  • Otherwise spying key-presses on that machine to obtain the password.
  • Password search (including by compromising this user's other passwords and trying variations); that's an industry that has several professional-looking offers, targeting at least law-enforcement budgets (your guess of other users is as good as mine). It works for encrypted data at rest, as in the question.
  • Finding the desired data (or the password) in a non-encrypted area, such as swap space, sidestepping the question's problem.

Directly breaking AES (even AES-128) by brute force is so hopelessly hard that it is unreasonable to even attempt that.

Side channel attacks (like timing attack and DPA) are entirely useless for encrypted data at rest, because the key is not there to be extracted.

AES implemented with AES-NI or other hardware is immune to timing attack, and I believe is immune to DPA on today's mainstream CPUs, except perhaps with most direct access to the CPU using the key (as feasible in Smart Cards); that's a risk, but a manageable one.

Improve this answer
$\endgroup$
3
  • $\begingroup$ Do you have a source for the claim that AES-NI is immune to DPA? $\endgroup$
    – SEJPM
    Mar 20, 2017 at 14:52
  • $\begingroup$ @SEJPM: uh, no. My assertion (which I toned down a little) is based on a combination of hearsay from a guy at BrightSight met on a both where he was demoing DPA attack, and my own assessment that the extremely poor signal/noise ratio of any acquisition likely to be feasible at a distance from a mainstream CPU will preclude a successful DPA attack. I give no insurance, YMMV, etc.. $\endgroup$
    – fgrieu ♦
    Mar 20, 2017 at 18:39
  • 2
    $\begingroup$ @fgrieu I can define the transistor behavior boundaries on "large" systems to prove that you cannot do a DPA against AES-NI due to the noise. Poisson's transport is responsible randomness in the arrival time of electrons across the channel, and even with the clock information, the "hiss" of transistors when you have 100M of them is significant. I would have no problem stating that AES-NI is immune against DPA without some modifications to the IC. (decapping it, taking a laser and cutting the power bus to the AES unit and reading it that way) $\endgroup$
    – b degnan
    Mar 20, 2017 at 19:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.