2
$\begingroup$

AEGIS, one of the finalists of CAESAR competition, uses a naive implementation of AES encryption round as its reference implementation. By naive I mean it uses secret dependent table lookups, so it is at a first sight vulnerable to side-channel attacks.

However, unlike AES which uses the same expanded key on all its rounds for the entire message, AEGIS uses its own internal state as the round keys, so all table lookups are in fact preudorandom.

Are side-channel attacks still possible for preudorandom table lookups as AEGIS does?

$\endgroup$
  • $\begingroup$ Side channel attacks are probably still possible, yes, but you won't hear about them being demonstrated for a while because AEGIS is not a high-value target like AES and it's a pain to carry them out well enough to get a paper out of it. Want to avoid side channels in software? Use designs that discourage variable-time logic and encourage constant-time logic. like ChaCha. $\endgroup$ – Squeamish Ossifrage Nov 4 '19 at 15:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.