# Cache Timing Attack SHA-3

I’ve been tinkering with SHA-3 for a little bit, and I have some questions regarding the applicability of cache timing attacks on this particular hash function. The two sub functions that I believe are susceptible to this particular attack are THETA and CHI. I think I can prove that THETA does not run in constant time, depending on the particular method with which the algorithm is implemented, and I believe CHI does not run in constant time either. To prove that statement with CHI would require the addition of break statements in some implementations of that function. Something that I have yet to complete.

Now assuming that the attacker only has access to a static SHA-3 hash output, I doubt that any information can be gained about the input. However assuming the attacker is able to monitor the execution time of the hash function things get more interesting. Although I'm not sure how prevalent this second scenario is in real life. All that would be gained is the total execution time of all 24 rounds of THETA, but would it be possible from this value to determine the execution time of individual rounds of THETA? Or then be able to approximate inputs based on execution time?

Does anyone know of any references/articles related to SHA-3 and cache timing attacks?

• Python is riddled with variable-time everything, including small integer arithmetic. – Squeamish Ossifrage Dec 15 '17 at 0:11
• @SqueamishOssifrage SHA-3 is a minefield, – Q-Club Dec 15 '17 at 7:15
• @ColinO'Neil Python just isn't the right choice for implementing production crypto primitives. You'll have similar problems with practically all algorithms. In languages with fixed-size integers, SHA-3 will naturally end up with a constant time implementation. – CodesInChaos Dec 15 '17 at 12:47

• @ColinO'Neil Here's the standard reference: cr.yp.to/papers.html#hash127 Although it naturally enables shifts and addition modulo $2^k$ for $k \leq 53$, it does not naturally enable the bitwise operations that SHA-3 uses, so it's not likely to be useful for SHA-3 implementation without obscene contortions. Your time would be far better spent just wrapping a C implementation in Python—or finding one someone else has already made. – Squeamish Ossifrage Dec 16 '17 at 2:54