I have seen several recent papers mention that side-channel resistance and countermeasure will be a major evaluation criterion for the NIST finalist candidates. However, I don't find any reference to this. Has NIST officially declared this criterion? I can find this document which has mentioned only about performance but nothing about side-channels. Thank you in advance for your help.
1
-
$\begingroup$ The keyword is call. $\endgroup$– kelalakaOct 6, 2021 at 10:00
Add a comment
|
1 Answer
$\begingroup$
$\endgroup$
In the initial call for submissions in section 4.A.6 Additional Security Properties, they do state:
Another case where security and performance interact is resistance to side-channel attacks. Schemes that can be made resistant to side-channel attack at minimal cost are more desirable than those whose performance is severely hampered by any attempt to resist side-channel attacks. We further note that optimized implementations that address side-channel attacks (e.g., constant-time implementations) are more meaningful than those which do not.
Although the language does not suggest that this is a major criterion, it is nevertheless at least a desideratum.
They also state in their report on the outcome of the second round (Section 4 Conclusion)
NIST hopes that with only seven finalists and eight alternate candidates, the public review period will include more work on side-channel resistant implementations, performance data in internet protocols, and performance data for hardware implementations in addition to more rigorous cryptanalytical study.
which could be regarded as increasing the emphasis.
