# Could affine transformation mod 2^128 be a side-channel attack problem

DFC cipher uses affine transformations mod $$2^{64}+13$$. Soon after DFC's publication, Ian Harvey raised the concern that reduction modulo a 65-bit number was beyond the native capabilities of most platforms, and that careful implementation would be required to protect against side-channel attacks, especially timing attacks.

Consider a cipher which is using affine transformations mod $$2^{128}$$. Is it still (it was 20 years ago) a problem to implement it securely? Will affine transformations mod $$2^{64}$$ make a big difference?

• On which platform? It is always the case that careful implementation would be required to protect against side-channel attacks, especially timing attacks. May 23 at 14:52
• I didn't think od which platform it could be. I thought about a uniwersal cipher, like AES. By the way DFC submitted to the AES competition. If if he won, would that be a problem today?
– Tom
May 23 at 23:38
• Which kind of side-channel attacks are you talking about? Just timing, or are you worried about differential power attacks (DPA), too? Protecting against latter will be quite difficult, as already switching between boolean masks and arithmetic masks (modulo power of 2) is not easy. For timing attacks you'll have to hope that multiplication with 13 (to which reduction modulo $2^{64}+13$ is easily reduced) is constant time. (Dealing with the carries in constant time might also not be easy in C when adding values mod $2^{64}+13$.)
– j.p.
May 24 at 8:14
• I think about every possible kind of side-channel attacks. And mostly I thought about modulo $2^{128}$. I have choice to use twice times modulo $2^{64}$ or modulo $2^{128}$ once. Implementing affine transformation have to be done carefully, but is it make a big difference in terms of security to use mod $2^{64}$ or mor $2^{128}$? In both cases we have affine transformations and I do not fully understand what the threat may be when we use a larger modulo.
– Tom
May 24 at 9:56

Having said that, you basically could not easily calculate something that large in this manner. $$2^{64}$$ is a huge number, and 64-bits quickly explodes into something large in the world of logic gates.