Questions tagged [side-channel-attack]

attacks using information leaked by implementations of cryptographic algorithms to obtain information about keys or (plaintext) data, instead of (or additional to) using cryptographic weaknesses.

Filter by
Sorted by
Tagged with
4
votes
0answers
56 views

Why do Edwards curves protect against side-channel attacks?

From Wikipedia: One of the attractive feature of the Edwards Addition law is that it is strongly unified i.e. it can also be used to double a point, simplifying protection against side-channel ...
1
vote
0answers
27 views

Side channel attack: Why building an eviction set is possible?

I'm learning about the side channel attack on the cache. I came to know that most of the attack (EVICT + TIME, PRIME + PROBE, PRIME + ABORT) on the cache is initiated by building an eviction set(a ...
0
votes
1answer
32 views

Questions about indexing a hash output to compose a final key

Recently I have watched the video Multi-Precision Arithmetic for Cryptology in C++, at Run-Time and at Compile-Time (at 21:56 seg) : The speaker says that to use a byte from the user key as a ...
1
vote
0answers
46 views

Side Channel Attack Evaluation Methods

I am studying the SCA Evaluation method success rate, and I have a doubt regarding to it. From my understanding, to calculate success rate, first we have a pool of traces all using same key and ...
2
votes
1answer
74 views

Fault attacks inside a loop

I am working on an attack that involves changing a constant inside a loop. Consider the simplified example is as below, ...
4
votes
0answers
56 views

Why is it safe to generate the secret key and masking vectors using rejection sampling in CRYSTALS-Dilithium?

In CRYSTALS-Dilithium module lattice-based digital signatures, the secret key vectors $s_1, s_2$ with coefficients in $[-\eta, \eta]$ and the signature masking vector $y$ with coefficients in $(-\...
2
votes
0answers
34 views

RSA: Blinding versus fixed-time computation

For RSA, what is the standard solution against timing attacks? I know about RSA blinding as one solution. Another solution is to always compute both the squared value and square-and-multiply values, ...
0
votes
1answer
103 views

Caculating Correlation for CPA attack on AES

I am having some trouble understanding how to calculate the correlation coefficient for CPA attack on AES. In the article Study of Deep Learning Techniques for Side-Channel Analysis and Introduction ...
6
votes
1answer
160 views

Does a masked look-up table prevent cache timing attacks?

When applying the boolean masking countermeasure to a cipher which uses an S-box $S$, a way to handle this nonlinear operation is to recompute a new S-box $S'$ such that $S'(x \oplus r_{in}) = S(x) \...
0
votes
1answer
46 views

What is the purpose of multiple key addition layers in AES?

I understand the purpose of the SubBytes layer (confusion) and the ShiftRows and MixColumns layers (diffusion). But I don't see the purpose of having more than one key addition layer. What I've been ...
2
votes
0answers
76 views

AES-128 8th round bit fault propagation

It's well known that by injecting a byte fault during the 8th round of AES 128 just before the mix column the key can be recovered with $2^{32}$-key space. A brute force attack is then possible but ...
18
votes
1answer
900 views

If a single bit was known through all states in AES, which would cause the most information to leak?

This question is motivated by some bad Verilog. Due to someone being sloppy with port assignments and a output statement, I have an AES core that has a single-bit from a S-Box in the key schedule ...
2
votes
1answer
81 views

Attacks on one-time pad, given a property of keys

An adversary $A$, eavesdrops $n$ cipher-texts, $c_{1}, c_{2} ..., c{_n}$. It also knows a value $v$ and a function $f$ such that $$f(k_{1}, k_{2}, ..., k_{n}) = v$$ where, $k_{i}$ is used to encrypt $...
2
votes
2answers
50 views

Does side-channel attacks offer any difficulty to Stinson's concept of `provable security'?

Here's a quote from Douglas Stinson: “[i]f a cryptosystem can be ‘broken’ in some specific way, then it would be possible to efficiently solve some well-studied problem that is thought to be ...
2
votes
1answer
68 views

Statistical (innefective) Fault Attacks on DES

I read this paper: Exploiting Ineffective Fault Inductions on Symmetric Cryptography. I was wondering if the same idea is applicable for DES. I know both algorithms are symmetric but the idea is not ...
2
votes
1answer
105 views

Timing Side Channel on error-correcting code

This question may be a basic question but it is not clear to me at the moment. I have an Error Correcting Code (ECC) in a key-encapsulation scheme designed for post-quantum cryptography which ...
8
votes
2answers
2k views

How to avoid side channel attacks when handling large numbers?

For cryptography, the platforms have limited size as 32 or 64-bit operations. We definitely need big numbers to implement the encryption/decryption and digital signatures for cryptosystems like RSA, ...
2
votes
1answer
334 views

Fault attack on RSA-CRT

I am trying to understand fault attack on RSA-CRT, and I found some example, which I don't know how to solve it. I know public modulus $N$, public exponent $e$, a value of faulty signature (where ...
2
votes
0answers
226 views

RSA most significant bit oracle attack

I have been reading up on RSA attacks and came across a problem that could be called a most-significant-bit (MSB) oracle attack. For the sake of clarity, let's define RSA primes $(p, q)$, private key ...
4
votes
0answers
117 views

Why are matrices so common in symmetric encryption?

Matrices have been used in symmetric ciphers since the Hill Cipher (before?) all the way up to modern ciphers such as Twofish and AES. I understand matrices can be invertible, therefore making them ...
2
votes
1answer
161 views

How to Prevent Correlation Power Analysis Attack on AES?

Which techniques could be applied to AES to prevent these kind of attacks? I can just think of creating noise with a parallel process for random computation, so the signals have the combination of ...
0
votes
1answer
98 views

Regarding Lattice atttacks on ECDSA with a portion of known bits of the nonce k

I am new in the field of cryptography, and I am having some troubles understanding a concept regarding the lattice dimension needed in the attack on ECDSA using several messages with L known bits of ...
-2
votes
1answer
586 views

side channel attack on RSA [duplicate]

A side-channel attack is any attack based on information gained from the implementation of Encryption protocol and by monitoring security-critical operations. Almost every encryption had a side-...
2
votes
0answers
48 views

How do we perform second order differential power analysis attack?

I have read papers which describe that the power traces(acquired from a side channel resistant implementation like masking) need to be centered and squared, then a correlation needs to be performed ...
8
votes
1answer
189 views

Can the lengths of HTTPS requests be used to deduce which public pages on a site are visited?

I thought of this recently: There are some websites which have many publicly accessible pages, some of which could be embarrassing despite being public (e.g. Wikipedia). The HTML for these pages also ...
1
vote
1answer
71 views

Montgomery Powering Ladder and Side Channel Attacks: Is it practically (im-)possible to analyze where intermediate values are stored?

The Montgomery Powering Ladder performs an exponentiation with the operations square and multiply (called double and add in the case of elliptic curves). To my knowledge the order and kind of ...
3
votes
2answers
194 views

Why does side-channel security focus on “shielding” rather than “jamming”?

I have always found it weird when in a crypto discussion people stressed the importance of making algorithms runtime-deterministic, to the point of avoiding any compiler optimisations. To me, it ...
2
votes
1answer
114 views

Side-Channel attack on RSA decryption using comparison result with p,q?

I was pointed to whether we could learn the secret key of RSA by repeatedly using following side channel: We assume that there exists a side channel in RSA decryption using CRT that, if the most-...
4
votes
4answers
232 views

Mitigating Side Channel Attack (SCA)

The SCA power attack described in 2016 article called "Power Side Channels in Security ICs: Hardware Countermeasures", depends on the measurement of power consumption fluctuations during AES-128 ...
0
votes
0answers
43 views

(Side channel) attack on a PIC18 micro controller

I'm trying to get some practical experience on (side channel) attacks. First I want to note all possible vulnerabilities. I thought about: Preset I have physical access and I own/wrote the software, ...
1
vote
1answer
53 views

Side Channel Analysis (CorrPA), comparison between HW-results and measured power traces

I think I have missed something very fundamental. I am trying to understand the step in DPA where you compare your hypothetical power consumptions with your measured ones. The Matrix H with Matrix T. ...
1
vote
2answers
461 views

Constant time implementations of crypto algorithms

To protect against cache attacks (side channel attacks) generally constant time crypto implementations are advised. In some cases DJB released new algorithms (chacha) that are designed with this in ...
1
vote
0answers
136 views

AES Fault Attack

Induce random fault (non-zero) error in one byte before MixColumns in Round 9 I get last round key with 32 bit (4 bytes) missing (Missing are bytes 1, 8, 11, 14) How can I recover these key bytes ...
6
votes
1answer
421 views

Does blinding work against side channel on RSA?

In the so called "blinding" technique for RSA, prior to decryption, the ciphertext is multiplied by random $r$ raised to the power of $e$; e.g., $C$ is replaced with $C\cdot r^e$; and then after ...
0
votes
1answer
220 views

S-box and Side Channel Attacks

S-boxes with non-linearity greater than 112 are considered prone to side channel attacks. If a non-linear S- box with non- linearity greater than 112 (excluding bent functions with non-linearity of ...
6
votes
3answers
697 views

Why don't table lookups run in constant time?

The Wikipedia article on big O notation says that performing a lookup is a constant time operation. So why are lookup tables susceptible to timing attacks?
6
votes
1answer
98 views

Is the context of “constant time” algorithms inclusive when you have a clock control?

There is generally a push to make algorithms and components constant time to be resistance to side channel attacks. For instance, AES-NI instructions take as many cycles as rounds; however, I can ...
1
vote
0answers
32 views

Randomness in Trichina's secure AND operation

In this paper, Elena Trichina introduces a way to compute a masked AND operation. The principle is the following: Having two operands $a$ and $b$ masked with random boolean shares $x$ and $y$ ($\...
8
votes
1answer
399 views

Do people not care about side channel resistance?

Recently, I have been browsing a lot through libraries that implementing Shamir secret sharing. I see a lot of code that implements this cryptographic algorithm without any side channel (timing/branch/...
2
votes
1answer
249 views

AES: a question about dual ciphers and security

I have recently learned of dual ciphers, in particular dual ciphers of AES. It seems there are many. Most of my information comes from:(1) Representations and Rijndael Descriptions. In this paper the ...
7
votes
3answers
357 views

Are there any symptoms of a side channel attack on the target chip?

I would like to know if there are some symptoms that let me detect if my integrated circuit is actually subject to a side channel attack. For example, are the following potential indicators? ...
0
votes
1answer
187 views

SPA resistant RSA trace

I am trying to perform simple power analysis on RSA. In particular focusing the modular exponentiation module and for this I have implemented left-to-right variant of binary exponentiation. pseudo ...
6
votes
2answers
528 views

RSA Timing Attack on “Extra” Montgomery Reduction

In "A practical implementation of the timing attack", the authors take advantage of a timing difference that stems from "extra reductions" that occur when multiplying numbers in the Montgomery form. ...
8
votes
1answer
323 views

Deterministic RSA blinding

I have an implementation of the RSA private key operation in a context where I don't have access to an entropy source. I'd like to add blinding to it (both message and exponent), to make it resist ...
2
votes
1answer
289 views

Cracking a key using a combination of partial keys

As part of a cryptanalytic attack I've carried out, I used a divide-and-conquer strategy to divide the secret key $k$ into several equal-sized partial keys $k = {k_1, k_2, ...}$. The attack works ...
4
votes
1answer
319 views

Dilithium signature scheme and timing attacks – Does the running time actually depend on the secret key?

The paper “CRYSTALS – Dilithium: Digital Signatures from Module Lattices” (by Léo Ducas, Tancrède Lepoint, Vadim Lyubashevsky, Peter Schwabe, Gregor Seiler, and Damien Stehlé) introduces a digital ...
1
vote
1answer
78 views

Scenario for applying power analysis

I have started doing some reading about power analysis (SPA, DPA), and it is not clear to me in what Scenario one would have to fear such an attack. It appears to me that a typical situation is ...
1
vote
2answers
241 views

Sliding windows implementation (Exponentiation by squaring)

I am conducting a research on cpu-cache based info leak caused by using Sliding window in the diffie helman key exchange. For my research I am looking for a real-world implementation of sliding ...
17
votes
2answers
1k views

Can deterministic ECDSA be protected against fault attacks?

In a paper by Barenghi and Pelosi, it was described that fault attacks could be used to derive the secret key when using deterministic ECDSA as described in RFC6979 by @Thomas_Pornin Deterministic (...
0
votes
1answer
80 views

How many AES-operationes have to be watched for key-exploit by side channel attacks?

if I would like to exploit a used key by the side channel attack, where you measure electromagnetic fields, how many runs of the AES-128 do I need to spy for a successful exploit? I can't use any ...