Questions tagged [side-channel-attack]
attacks using information leaked by implementations of cryptographic algorithms to obtain information about keys or (plaintext) data, instead of (or additional to) using cryptographic weaknesses.
227
questions
7
votes
3
answers
1k
views
New causes of side channel
Until recently, my list of what can cause side channels exfiltrating secret data (including data depending on secrets) from code running in a computer was limited to:
Hardware emissions: power (e.g. ...
- 144k
3
votes
2
answers
846
views
How do cache-timing attacks determine the secret keys of encryption algorithms?
In cache-timing attacks like prime+probe, attacking programs are able to discover the addresses of a victim program's data in main memory. These attacks are often used to determine the secret keys ...
- 33
1
vote
0
answers
98
views
ECDSA biased nonce with biased middle bits
The paper "Biased nonce sense" (https://eprint.iacr.org/2019/023.pdf) covers key recovery for MSB and LSB, the latter case being handled by doing modular inverse of 2 to the power of the ...
- 11
0
votes
0
answers
35
views
Correlation power analysis of AES hardware implementation
In software, finding the outputs of the s-boxes is easier because these values would need to be loaded from memory onto a high-capacitance data bus.
On hardware, the output of the s-boxes may be ...
- 43
0
votes
0
answers
60
views
How to find openSSL's AES T-table location for cache side channel attack
Let us assume I have a physically-indexed last-level cache, which is shared between the victim and adversary. Both the victim and attacker have their own copy of openSSL library in the caches. Victim ...
- 31
2
votes
1
answer
179
views
AES vs Serpent - which is more side-channel resistent?
I learned that some AES implementations are vulnerable to side-channel attacks due to how the SBOX structure is implemented. The output have to be nonlinear, therefore having low bit inputs results in ...
- 43
1
vote
0
answers
276
views
Need help with Cryptohack's ProSign 3 ECDSA problem [closed]
I'm trying to solve the CTF challenge called ProSign 3 at Cryptohack platform which involves exploiting an ECDSA signing service that allows us to sign a fixed message being padded with the time ... ...
3
votes
1
answer
342
views
Implications of switching RSA padding schemes
In my company we want to switch from PKCSv1.5 to PSS for RSA signing. This is because of the marvin attack vector.
My question is, if an adversary can see many similar messages that were signed with ...
- 133
3
votes
1
answer
183
views
What could be the side-channel attacks countermeasures other than secure memory overwriting?
I'm seeking guidance on mitigating side-channel attacks in a cryptographic application where securely overwriting memory with zeros after use may not always be feasible. While I understand the ...
- 159
0
votes
2
answers
127
views
Has garbage-collection been used for side-channel attacks?
I'm thinking of cryptographic implementations on garbage-collected (gc) languages/runtimes and that the gc process can be potentially dangerous for an implementation even if the implementation has the ...
- 982
3
votes
0
answers
122
views
How do you securely implement a finite field?
I'm not sure if this question belongs here or to StackOverflow. Please flag it if not.
I'm trying to implement a standalone library for finite field arithmetic of prime and prime power order as a way ...
- 982
1
vote
3
answers
137
views
Is an if-else calling same function(s) vulnerable to side channel attacks
If I have a function f(x, y) and g(x, y) and f and g a are constant time, is the following code vulnerable to side channel ...
- 13
2
votes
1
answer
280
views
Choosing (key,plain) to produce zero state in middle rounds of AES encrypt
I was told in passing that (key, plain) pairs could be chosen to produce a zero state in AES encrypt in some middle round (say 5). [The application here being to side-channel leakage assessment.] ...
- 420
1
vote
0
answers
80
views
Where do we put known bits of nonce when performing lattice attack on ECDSA?
I have read so many papers and posts about lattice attacks on ECDSA but none of them used an example of different MSB values for k but instead they all used fixed MSB.
So here i am trying to ...
0
votes
1
answer
105
views
Can attackers see the values I pass on to OpenSSL API functions?
Respected community,
I am using the OpenSSL API's, especially libcrypto and libssl and I am really depressed, thinking about ...
- 1,060
4
votes
0
answers
162
views
Masking countermeasures for AES-GCM
Suppose I have a masked AES encryption $AES(\oplus_i K_i, \oplus_i P_i)=\oplus_i C_i$, i.e. the key, plaintext, and resulting ciphertext are tuples $K_i$, $P_i$, and $C_i$ that sum to $K$, $P$, and $C$...
- 420
2
votes
1
answer
158
views
Constant-Time Base64 Codec - Necessity and Implementation
As we know, the popular PEM format for textualizing private key binary blobs uses base64 encoding. Typical base64 codecs use look-up tables to find characters and byte values and pack them together, ...
- 9,672
1
vote
1
answer
67
views
Does compressed data expose information about non-compressed data when encrypted together?
I know that compressing data before encrypting it can cause a compression oracle attack such as in the CRIME and BREACH attacks, but if only part of the data is compressed, e.g. non-user controlled ...
- 11
1
vote
1
answer
131
views
In hardware, why using an algebraic implementation of a (small) S-Box instead of a LUT?
There is this cool paper https://eprint.iacr.org/2017/395.pdf exposing a side channel protected implementation of keccak, in particular Domain Oriented Masking for the Chi function.
The Chi function ...
- 11
5
votes
2
answers
120
views
How to prevent power analysis on software level?
When attacking RSA with Square&Multiply, one can figure out the secret key by looking at the exponentiation algorithm itself. To prevent this in software, we could use dummy multiplications after ...
- 51
1
vote
1
answer
96
views
Constant-time decompression on an elliptic curve
Let $E\!: y^2 = f(x)$ be an elliptic curve over a finite field $\mathbb{F}_{q}$ of odd characteristic. Consider an $\mathbb{F}_{q}$-point $P = (x,y)$ on $E$. Suppose that we only have the $x$-...
- 425
1
vote
0
answers
91
views
Issue with understanding Side Channel Attacks
I am currently working on Side Channel Attacks (SCA) on Kyber and Dilithium. I have found myself quite confused with side channel, because so much is mentionned all the time.
For instance, I don't ...
- 51
0
votes
1
answer
124
views
Difference between Decryption-failure and Plaintext-checking oracles
I am reading this paper, which in the introduction, tells about two main types of key recovery SCAs :
Reaction_type SCAs, which uses a decryption failure oracle
Message-recovery-type SCAs, which uses ...
- 51
1
vote
1
answer
96
views
Are you aware of cryptographic contexts (e.g., post-quantum) in which a square root $\sqrt{\cdot}$ must be computed in constant time?
Let $\mathbb{F}_q$ be a finite field of odd characteristic. I know that a constant-time implementation of the square root extraction $\sqrt{\cdot} \in \mathbb{F}_q$ is used in the context of hashing ...
- 425
2
votes
1
answer
91
views
why sbox input XOR sbox output can be sensitive data of side channel attack?
As several intermediate values are used as sentive data for side channel analysis (DPA), I don't understand why sbox input ^ sbox output is also wide-used and effective.
This value does not applied in ...
- 21
0
votes
1
answer
38
views
Fan et al. Recovering MSD's
I have been trying to understand the method of recovering the MSD of the nonce proposed by Fan et al. (section 4.2), in their attack targeting wNAF implementation for scalar multiplication in the ...
- 23
1
vote
1
answer
97
views
How new cache designs stop cache-based side channel attacks
How do new cache designs aid in defending against cache-based side-channel attacks?
While conducting a side-channel attack, we have the T-table/S-virtual box's address.
Normally, address mapping is ...
- 31
2
votes
1
answer
344
views
Generic attack on Hmac sha256
Is there any generic attack on HMAC SHA 256 ?
I am currently reading up on attacks on Hmac sha-256. However most of the papers I've found are about side channel attacks such as Differential power ...
- 33
0
votes
0
answers
188
views
How to get dp and dq of CRT-RSA?
I am learning to utilize flush+reload method to get private key of CRT-RSA.
CRT-RSA calculates two parts separately: mp = c^dp mod p and ...
- 101
6
votes
3
answers
3k
views
What do you call a random number that affects the calculation, but not the result?
This is about the same random ladder algorithm as my previous question. It computes f(g,n,r)=n*g or g^n (depending on the group notation), where g is a generator of a group. Suppose n=5882353. This ...
- 221
2
votes
2
answers
241
views
How do I try a timing attack on a public-key implementation on a general-purpose computer?
I'm writing a higher-order function in Haskell for use in public-key algorithms; it works equally well for RSA or elliptic curves. I'd like to test it for susceptibility to side channel attacks. How ...
- 221
6
votes
0
answers
249
views
Are side-channels a concern for AEAD key commitment fixes?
I'm currently debating whether to revert to a non-committing AEAD (ChaCha20-Poly1305) instead of a committing AEAD based on Encrypt-then-MAC (XChaCha20-BLAKE2b) for stream encryption. Borg backup made ...
- 2,060
0
votes
1
answer
95
views
Constant time empty string validation
Checks for null require an == check. If you have a string secret (say a hex-encoded key) and you want to check it's empty for validation should you compare it to <...
8
votes
2
answers
400
views
Is the elliptic-curve cryptography library libsecp256k1 not susceptible to the Hertzbleed attack?
I was reading up on the recently disclosed Hertzbleed side channel attack(s).
It was speculated on Twitter that the elliptic-curve cryptography library libsecp256k1 is not susceptible to these attacks....
- 207
2
votes
1
answer
90
views
Can cryptographic accelerators along with side channel attack be used for GPS spoofing?
While having a discussion with someone on a forum about GPS spoofing, he mentioned that GPS signal can be spoofed for a cruising missile and make it land somewhere else using side-channel attack along ...
- 23
3
votes
1
answer
504
views
Correlation Power Analysis on AES - possible attack models
As far as I know it is possible to extract the key or key parts using side channel power analysis attack on AES, but we need some strong attacker model in order to do that. The first attack I know ...
- 31
2
votes
1
answer
120
views
Pros and cons about padding a cryptogram produced with an "additive" operation mode
These days I found myself thinking about the implications of padding or not padding block cipher modes that act like additive stream ciphers (I meant OFB, CTR, GCM etc). Let's call additive modes.
You ...
- 23
0
votes
0
answers
66
views
RSA private key revealing by decrypting c=n-1
In RSA, if we use Square and always Multiply algorithm in decryption, how does decrypting the ciphertext $c=n-1$, while our public key is $(n,e)$, cause the private key $d$ to reveal due to side-...
0
votes
0
answers
100
views
Masked RSA/BigInt Arithmetic?
Masking is the process of replacing operations (internally to some cryptographic algorithm) on intermediate values with operations on secret shared values. Then, even if some number of these secret-...
- 13.8k
0
votes
1
answer
502
views
Is CBC mode of encryption still safe as long as it's not use to send messages over a network?
I'm still reading about the Padding Oracle attack and Side Channel attack that can be performed to decrypt cipher text encrypted with CBC though it's still not clear to me.
But base on my little ...
- 105
1
vote
1
answer
274
views
Timing attacks: Symmetric vs Asymmetric Algorithms
There is a statement that I can't give a reference;
"Since the timing characteristics of symmetric algorithms are not as key dependent as asymmetric algorithms, they are more resistant against ...
- 640
1
vote
1
answer
678
views
Is it okay to avoid a plaintext IV in AES?
The scenario
Using AES 256 with CBC mode. (Authentication is done separately. Ignored here.)
The goal (explained more later)
To avoid sending an unencrypted IV.
But since this is being done using .NET ...
- 2,045
2
votes
1
answer
221
views
What is reaction attack?
In the paper of "Reaction Attacks against Several Public-Key Cryptosystems" CiteSeerX link, reaction attack is defined informally as "Obtaining information about the private key or ...
- 640
5
votes
2
answers
912
views
Post-quantum algorithms and side channel attacks
I am studying finalist algorithms of NIST Post-Quantum Cryptography Standardization. I noticed that almost all third party cryptanalysis papers consist of side-channel attacks. Why are classical ...
- 640
2
votes
1
answer
91
views
Threshold implementation of ciphers
What is the principle behind threshold implementation of block ciphers and how is this protecting against side channel attacks?
- 1,106
3
votes
2
answers
233
views
Protecting AES via Shamir Secret Sharing
This is about the paper Protecting AES with Shamir's Secret Sharing Scheme by Louis Goubin and Ange Martinelli which describes how to use Shamir Secret Sharing to obtain masked implementations of AES.
...
- 131
1
vote
0
answers
184
views
How is the Argon2d side channel attack performed?
How should the adversary behave in order to perform a successful side channel attack against Argon2d?
I'm trying to understand the scenario that Argon2i tries to resist against.
- 573
1
vote
1
answer
83
views
What are the security implications of RSA decryption of ciphertext >= modulus?
While reading through the sections about decryption in PKCS#1 v2.2, I noticed that the decryption algorithms are required to output the failure symbol: ...
- 9,672
2
votes
0
answers
81
views
Randomization of ECDSA signing operations to prevent SCA
A large number of SCA papers that talk about ECDSA mention the need for blinding/randomisation of the signing process, typically with a single-sentence comment about replacing the projective ...
- 357
1
vote
1
answer
189
views
How feasible is it to guess the private key of libsodium by taking into account generation time?
So suppose you are doing this locally (so no network noise), and know the exact specifics of your processor too. Is it feasible to figure out the private key (while having access to the public-key) ...
- 799