1
$\begingroup$

I have seen several recent papers mention that side-channel resistance and countermeasure will be a major evaluation criterion for the NIST finalist candidates. However, I don't find any reference to this. Has NIST officially declared this criterion? I can find this document which has mentioned only about performance but nothing about side-channels. Thank you in advance for your help.

$\endgroup$
1
  • $\begingroup$ The keyword is call. $\endgroup$
    – kelalaka
    Commented Oct 6, 2021 at 10:00

1 Answer 1

1
$\begingroup$

In the initial call for submissions in section 4.A.6 Additional Security Properties, they do state:

Another case where security and performance interact is resistance to side-channel attacks. Schemes that can be made resistant to side-channel attack at minimal cost are more desirable than those whose performance is severely hampered by any attempt to resist side-channel attacks. We further note that optimized implementations that address side-channel attacks (e.g., constant-time implementations) are more meaningful than those which do not.

Although the language does not suggest that this is a major criterion, it is nevertheless at least a desideratum.

They also state in their report on the outcome of the second round (Section 4 Conclusion)

NIST hopes that with only seven finalists and eight alternate candidates, the public review period will include more work on side-channel resistant implementations, performance data in internet protocols, and performance data for hardware implementations in addition to more rigorous cryptanalytical study.

which could be regarded as increasing the emphasis.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.