If I want to encrypt some payload with AES-GCM, with the Web Cryptography API, how resistant would this be against side channel attacks?


The safe academic thing is to assume that no, something using the Web Cryptoraphy API can not be assumed resistant to side-channel attacks.

The Web Cryptography API is, as the acronym states, an Application Programming Interface. What it does is platform-dependent. For example, in a browser environment, the code that implements that API is browser-dependent (including version), and what it interfaces to can be OS-dependent (including version). User-settings may matter, compilation options of the native code often do. Plus, the feasibility of side channel attacks turns out to be CPU-dependent, microcode-of-the-CPU-dependent, setting-of-the-BIOS-or-virtualization-environment-if-any-dependent...

However, the worst is not certain! Actual feasibility of side channel attacks is extremely attacker-capabilities-dependent, and quite often it is pointless to assume that the attacker has a foot in the client machine (for in this case the attacker has options beyond side-channel attacks). And once there is the constraint to be platform-independent, perhaps the Web Cryptoraphy API is the best thing to use: rolling one's own side-channel-resistant implementation in JS is bound to be much less efficient than a native implementation, hard to the point of being next to infeasible, potentially ruined by the execution environment, and rightly recommended against by every expert.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.