Questions tagged [side-channel-attack]

attacks using information leaked by implementations of cryptographic algorithms to obtain information about keys or (plaintext) data, instead of (or additional to) using cryptographic weaknesses.

Filter by
Sorted by
Tagged with
1
vote
0answers
28 views

How is the Argon2d side channel attack performed?

How should the adversary behave in order to perform a successful side channel attack against Argon2d? I'm trying to understand the scenario that Argon2i tries to resist against.
1
vote
1answer
38 views

What are the security implications of RSA decryption of ciphertext >= modulus?

While reading through the sections about decryption in PKCS#1 v2.2, I noticed that the decryption algorithms are required to output the failure symbol: ...
2
votes
0answers
38 views

Randomization of ECDSA signing operations to prevent SCA

A large number of SCA papers that talk about ECDSA mention the need for blinding/randomisation of the signing process, typically with a single-sentence comment about replacing the projective ...
1
vote
1answer
57 views

How feasible is it to guess the private key of libsodium by taking into account generation time?

So suppose you are doing this locally (so no network noise), and know the exact specifics of your processor too. Is it feasible to figure out the private key (while having access to the public-key) ...
2
votes
1answer
61 views

Role of AND operation in Side Channel Security

I was going through a side channel protection. It seems in the 3-shares (Appendix A) or 4-shares (Appendix B) has some computations that grows with the number of AND operations. My question: Is there ...
0
votes
0answers
20 views

Non-linear phase that's Side channel attack proof

I'm designing a cipher and I'm looking for a Non-linear phase in my cipher that is side channel attack proof, I know that Sboxes are vulnerable to to that because of accessing the cache. I'm thinking ...
1
vote
1answer
46 views

Could affine transformation mod 2^128 be a side-channel attack problem

DFC cipher uses affine transformations mod $2^{64}+13$. Soon after DFC's publication, Ian Harvey raised the concern that reduction modulo a 65-bit number was beyond the native capabilities of most ...
0
votes
0answers
41 views

Why does Montgomery Ladder not work for Brainpool curves

According to SafeCurves, the Brainpool curves mentioned there (P256t1 and P384t1) do not support the Montgomery Ladder for scalar multiplication in constant time. I am wondering why this is the case ...
1
vote
0answers
26 views

Does Argon2id provide less protection against side-channel attacks than Argon2i theoretically and/or practically? [duplicate]

LUKS 2 encryption uses Argon2i as the default PBKDF. As the key is used on each access, I guess side-channel attacks are a significant threat factor. However, as I'm not a cryptographer, I am not ...
2
votes
1answer
130 views

How to express difficulty of breaking crypto when writing?

When writing for both technical and non-technical readers I find my self naturally wanting to write things such as : "..therefore it would be impossible to decrypt the data." When trying ...
0
votes
1answer
60 views

Are side-channels possible in KDFs

Are KDFs such as PKDF2 and HKDF vulnerable to side-channel attacks such as static and dynamic power analysis including the hash type used internally?
5
votes
1answer
560 views

What is the Lord of the Ring(s): Side Channel Attack and What are the results

A recent Paper to appear on USENIX Security 2021 titled as Lord of the Ring(s): Side Channel Attacks on the CPU On-Chip Ring Interconnect Are Practical by Riccardo Paccagnella Licheng Luo Christopher ...
1
vote
1answer
69 views

Is this constant-time comparison secure?

I was thinking about constant-time comparison and how it differs from "==", when I thought of a simple way that's could be constant-time. Being a beginner in cryptography, I'd like to know ...
0
votes
0answers
19 views

Conditional probability being Constant in Threshold Cryptography

I am working on Threshold implementation of algorithms to prevent side channel attacks. I am not that much proficient in Statistics and Probability theory. I want to know what is the significance of ...
4
votes
0answers
183 views

secp256k1 scalar decomposing and prime field arithmetic

I'm currently studying the elliptic curve secp256k1 implementation. In my understanding, it has efficiently computable endomorphisms: We can find out a pair of number $\lambda$ and $\beta$ from the ...
2
votes
0answers
68 views

Is this "AND" implementation safe against side channel attacks?

I found out that the following is a working implementation of calculating an AND function between XOR masked shares, implementation at Github. It works by calculating parities, whose terms cancel each ...
4
votes
2answers
866 views

Side-Channel Attacks in the Cloud

Let's say we have some very sensitive personal files. At all costs, we do not want any other pair of eyeballs to gaze upon them. We need these sensitive files to be secure and available. So, we have ...
1
vote
0answers
72 views

Dragonfly masked DH

I was looking at Dragonfly key exchange protocol RFC 7664, and it seems to make use of masked Diffie-Hellman in the final part. Generating two random numbers less than group order $q$, $m$, and $r$ ...
2
votes
1answer
105 views

Constant Time algorithms for $\mathbb{Z}/m\mathbb{Z}$, $\mathbb{Z}/m\mathbb{Z}[x]$, and $\mathbb{Z}/m\mathbb{Z}[x] / (f(x))$?

I want to implement some (lattice based) protocols to better familiarize myself with a programming language (Rust). These tend to do arithmetic over rings like $\mathbb{Z}/m\mathbb{Z}$, or "...
10
votes
2answers
844 views

What is a "constant time" work around when dealing with the point at infinity for prime curves?

I've been working for some time, on designing a constant time solution for dealing with the "point at infinity" for prime curves. So, far I'm using the Standard Projective Coordinates for ...
3
votes
0answers
86 views

Constant time arithmetic implementation in DSA

I am trying to understand why it is a hard problem to have formally verified constant time arithmetic for DSA when compared with ECDSA. For instance, in ECDSA implementations of OpenSSL, we have ...
1
vote
0answers
54 views

Hashing of variable-length chunked data leading to leakage of secret key from side channel?

Hypothetically, secret data could be hashed in some schemes in one way or another. Could chunking of the data lead to exposure of secret component through side channel? Say converting a randomized ...
2
votes
1answer
65 views

Why shouldn't cryptocurrency hash algorythms, resist side channel attack?

2015's Argon2 publication suggests that cryptocurrency hashing like password hashing on backend servers should not be subject to side-channel attack: Argon2d is optimized for settings where the ...
1
vote
2answers
86 views

Side channel attack - execution time depends on the size of the key

In my algorith execution time depends on the size of the key. It is a linear relationship (probably). The larger the key, the longer the algorithm takes to run. I have a code in Python so far. For ...
0
votes
1answer
62 views

Stream slicing operation in block cipher and side-channel attack

My symmetric block cipher works kind of like a stream cipher, but it works on $128$-bit blocks. It generates a $128$-bit block in every round. And at the end of the round, I have to slice it into two ...
2
votes
0answers
74 views

Is "double-and-add-always" a good mitigation against side channel attacks?

In Discrete Log based Cryptography, one of the core operations that one, has to perform is modulo exponentiation. There are many algorithms to choose from, especially, when considering my point of ...
3
votes
1answer
180 views

Have crypto side-channel attacks happened in the wild?

I'm aware of attacks extracting information via timing and volume. But none that care or attack the actual cryptographic algorithm implementation or end up extracting the key. Seeking examples if any ...
-2
votes
2answers
201 views

Will OTP provide quantum resistance under 5 conditions?

We already have quantum computing, but when quantum computing becomes commercially available there is a problem for many but not all encryption algorithm. The One-Time-Pad or OTP is the one and only ...
1
vote
0answers
25 views

How to find the output shares of first-order threshold implementation of cubic degree function?

Assume $d=abc$ and to implement first order threshold implementation , the minimum input and output shares are 4 (1*3+1) , and 4 , calculated using ${4\choose 3}$ , Theorem 2. The new TI ...
0
votes
1answer
59 views

Shuffling: Purpose and formal definition

To my understanding, shuffling means simply to permute the elements in vector $\mathbf{v}$ pseudorandomly, using a PRP $\pi (\mathrm{seed},\mathbf{v})$. A secure PRP should yield a permutation ...
7
votes
1answer
88 views

What quality of randomness is needed for randomized side channel countermeasures?

Using per-operation randomness is a popular and effective way to protect cryptographic implementations against side-channel attacks, e.g. using Shuffling (randomizing the processing order eg for AES ...
4
votes
2answers
544 views

Constant time multiplication in GF(2^8)

I am trying to implement AES in C; I would like to make it resistant to side-channel attacks but I can't implement the multiplication in constant time. My current code: ...
7
votes
0answers
201 views

How to implement arbitrary s-box in a side-channel-free way in C?

This could be a question for CodeReview.SE, but I thought it might require non-trivial cryptographic knowledge to merit it on-topic here. The C language is chosen as it's a common language for ...
1
vote
0answers
70 views

How vulnerable are SIMD operations to side channel attacks?

For a while, I was experimenting with optimization of several crypto implementations with SIMD (Single Instruction Multiple Data ) made available by C compiler ...
13
votes
1answer
2k views

Safely sorting secret data

Suppose you have a secret list of n distinct integers. How would you sort this list in a way that is not vulnerable to timing attacks? I tried looking up "...
2
votes
1answer
207 views

Is AES without T-Tables nor S-Box resistant to side-channel?

T-Tables and S-Boxes are prone to side-channel attacks, is an implementation without any lookup tables resistant to side-channel ? In this answer, https://crypto.stackexchange.com/a/63520/80926, the ...
1
vote
1answer
185 views

Is AES S-Box resistant to side-channel attacks?

I know that implemntations with T-tables such as Golang's are prone to side-channel attacks, but is AES's S-Box wihtout any additional table also insecure ?
3
votes
1answer
168 views

Timing attacks on homomorphic encryption

I've been wondering for a long time about programs that could potentially break fully homomorphic encryption schemes: ...
0
votes
1answer
62 views

Application of Non-deterministic Processors in side channel attacks

I was reading the abstract of "Non-deterministic Processors" paper by "David MayHenk L. MullerNigel P. Smart", in the abstract, they have mentioned the Kocher paper about "Timing Attacks on ...
0
votes
0answers
88 views

How to prevent cache timing attack on table lookup AES implementation?

I've been trying to find a solid method to prevent cache timing or other possible side channel attacks on an AES implementation, that uses lookup tables for S-box substitution. I realize that there ...
1
vote
1answer
141 views

Does clustering the AES Sbox look up table to 32 bit entry per index, help reduce vulnerability to cache timing attacks?

I've been searching for some, easy methods to help mitigate, a cache timing attack on software AES implementations. Currently, my implementation uses, a usual 256 byte S-box ...
2
votes
1answer
121 views

Is it possible to perform CPA(Correlation Power Analysis) when attacker has only specific round's waveform?

I read Quite a lot document about breaking AES using CPA. But most of them, assuming that attacker has the first or last round of the waveform(trace) and exploit SubBytes. My question is if the AES-...
8
votes
1answer
2k views

How to confirm my implementation is constant time

I'm implementing Schnorr signatures following a variant used in Bitcoin Cash (BCH) of this algorithm: GitHub - Schnorr Signatures for secp256k1. A notable difference is that the BCH schnorr algorithm ...
0
votes
0answers
64 views

How does a cache timing attack work on AES with lookup tables?

I was trying to make a software only implementation of AES (Rijndael). At first I was able to implement it using table lookups for the Galois field multiplication and also for the SBox, but, I really ...
1
vote
0answers
64 views

Help on Algebraic Side Channel Attacks

I am a master student in computer security, I am preparing a dissertation thesis in the theme is: Algebraic cryptanalys by auxiliary channels, I need reference on this theme (book, thesis, ...), and ...
3
votes
1answer
168 views

Is Ed25519 really constant-time as widely implemented?

Despite the frequent claims that Ed25519 is more secure against side-channel attacks than (for instance) signatures performed over NIST P-256, I noticed that most implementations (including the ...
5
votes
1answer
154 views

Are there any masking methods for integer multiplication masking?

I'm interested in lattice type cryptosystem such as Mod-LWR. But I found that integer multiplication¹ is not safe for side-channel attacks. I tried to make masking method by own method but it failed ...
3
votes
0answers
117 views

Neural networks in Differential Power Analysis?

I am trying to understand how neural networks are used to do DPA, but I am having trouble understand DPA. My current understanding is that with DPA, we are just guessing one piece of a key at a time, ...
0
votes
0answers
169 views

Computing guessing entropy (average rank of the correct key) in attack using deep learning

I am looking for help with some issues that I have about the guessing entropy (GE) in side-channel attacks context. I have read some papers where GE is used as a metric to measure the attack's ...
2
votes
0answers
53 views

Security of bit shift in Serpent

As far I know, the Serpent cipher is the only cipher that uses legit bit shifts (<<) along with circular left shift (...