I've already seen some topics on this matter, but I feel like my question hasn't really been answered.
Given the following:
- AES must be implemented in hardware (i.e. using the AES-NI instruction set) to ensure the best protection against side-channel attacks that target the algorithm's implementation (because of MixColumns operations)
- Other encryption algorithms such as the Salsa20 family and NORX are less prone to such issues (if well implemented, at least in software)
...can we say that it is safer$^1$ to use such algorithms instead of AES if one may not ensure that AES-NI is properly implemented in the hardware that's being used ?
For instance, if one uses some x86-64 CPU that features this instruction set but whose design is kept secret, can AES be considered safe ? Respectively, are the other algorithms safe(r) on such a platform ?
$^1$Note that NORX is still in its early stages and has yet to win the CEASAR competition as well as withstanding the test of time, so it is only safe "on paper" for now
AESENC
,AESDEC
,AESIMC
, etc) take the same number of cycles to retire regardless of the plaintext or the key. As the only way to perform timing attacks on this level is throughRDTSC
, it is simple to prove that they are not vulnerable to these attacks. That doesn't mean that they aren't vulnerable to, e.g. power analysis attacks, though. $\endgroup$