Last call to make your voice heard! Our 2022 Developer Survey closes in less than a week. Take survey.

Questions tagged [side-channel-attack]

attacks using information leaked by implementations of cryptographic algorithms to obtain information about keys or (plaintext) data, instead of (or additional to) using cryptographic weaknesses.

Filter by
Sorted by
Tagged with
0 votes
0 answers
40 views

Side Channel Attacks on AES- Leakage Test

I have read the paper about testing a device for side channel leakage or if it is even possible to perform such an attack on the device. The idea is to perform a TVLA, which performs a welchs t-test ...
user avatar
  • 1
2 votes
1 answer
60 views

Can cryptographic accelerators along with side channel attack be used for GPS spoofing?

While having a discussion with someone on a forum about GPS spoofing, he mentioned that GPS signal can be spoofed for a cruising missile and make it land somewhere else using side-channel attack along ...
user avatar
0 votes
0 answers
26 views

Performing TVLA test without knowledge of the Key

https://www.rambus.com/wp-content/uploads/2015/08/TVLA-DTR-with-AES.pdf As the paper shows, we can check the hardware if it is vulnerable to side channel attacks by performing this test, although is ...
user avatar
3 votes
1 answer
90 views

Correlation Power Analysis on AES - possible attack models

As far as I know it is possible to extract the key or key parts using side channel power analysis attack on AES, but we need some strong attacker model in order to do that. The first attack I know ...
user avatar
0 votes
1 answer
45 views

Pros and cons about padding a cryptogram produced with an "additive" operation mode

These days I found myself thinking about the implications of padding or not padding block cipher modes that act like additive stream ciphers (I meant OFB, CTR, GCM etc). Let's call additive modes. You ...
user avatar
  • 3
0 votes
0 answers
53 views

RSA private key revealing by decrypting c=n-1

In RSA, if we use Square and always Multiply algorithm in decryption, how does decrypting the ciphertext $c=n-1$, while our public key is $(n,e)$, cause the private key $d$ to reveal due to side-...
user avatar
0 votes
0 answers
52 views

Masked RSA/BigInt Arithmetic?

Masking is the process of replacing operations (internally to some cryptographic algorithm) on intermediate values with operations on secret shared values. Then, even if some number of these secret-...
user avatar
  • 8,424
0 votes
1 answer
70 views

Is CBC mode of encryption still safe as long as it's not use to send messages over a network?

I'm still reading about the Padding Oracle attack and Side Channel attack that can be performed to decrypt cipher text encrypted with CBC though it's still not clear to me. But base on my little ...
user avatar
1 vote
1 answer
216 views

Timing attacks: Symmetric vs Asymmetric Algorithms

There is a statement that I can't give a reference; "Since the timing characteristics of symmetric algorithms are not as key dependent as asymmetric algorithms, they are more resistant against ...
user avatar
  • 370
1 vote
1 answer
104 views

Is it okay to avoid a plaintext IV in AES?

The scenario Using AES 256 with CBC mode. (Authentication is done separately. Ignored here.) The goal (explained more later) To avoid sending an unencrypted IV. But since this is being done using .NET ...
user avatar
  • 1,893
2 votes
1 answer
98 views

What is reaction attack?

In the paper of "Reaction Attacks against Several Public-Key Cryptosystems" CiteSeerX link, reaction attack is defined informally as "Obtaining information about the private key or ...
user avatar
  • 370
5 votes
2 answers
688 views

Post-quantum algorithms and side channel attacks

I am studying finalist algorithms of NIST Post-Quantum Cryptography Standardization. I noticed that almost all third party cryptanalysis papers consist of side-channel attacks. Why are classical ...
user avatar
  • 370
2 votes
1 answer
53 views

Threshold implementation of ciphers

What is the principle behind threshold implementation of block ciphers and how is this protecting against side channel attacks?
user avatar
3 votes
2 answers
127 views

Protecting AES via Shamir Secret Sharing

This is about the paper Protecting AES with Shamir's Secret Sharing Scheme by Louis Goubin and Ange Martinelli which describes how to use Shamir Secret Sharing to obtain masked implementations of AES. ...
user avatar
  • 131
1 vote
0 answers
56 views

How is the Argon2d side channel attack performed?

How should the adversary behave in order to perform a successful side channel attack against Argon2d? I'm trying to understand the scenario that Argon2i tries to resist against.
user avatar
  • 519
1 vote
1 answer
47 views

What are the security implications of RSA decryption of ciphertext >= modulus?

While reading through the sections about decryption in PKCS#1 v2.2, I noticed that the decryption algorithms are required to output the failure symbol: ...
user avatar
  • 6,551
2 votes
0 answers
46 views

Randomization of ECDSA signing operations to prevent SCA

A large number of SCA papers that talk about ECDSA mention the need for blinding/randomisation of the signing process, typically with a single-sentence comment about replacing the projective ...
user avatar
  • 347
1 vote
1 answer
83 views

How feasible is it to guess the private key of libsodium by taking into account generation time?

So suppose you are doing this locally (so no network noise), and know the exact specifics of your processor too. Is it feasible to figure out the private key (while having access to the public-key) ...
user avatar
  • 637
2 votes
1 answer
66 views

Role of AND operation in Side Channel Security

I was going through a side channel protection. It seems in the 3-shares (Appendix A) or 4-shares (Appendix B) has some computations that grows with the number of AND operations. My question: Is there ...
user avatar
  • 593
0 votes
0 answers
21 views

Non-linear phase that's Side channel attack proof

I'm designing a cipher and I'm looking for a Non-linear phase in my cipher that is side channel attack proof, I know that Sboxes are vulnerable to to that because of accessing the cache. I'm thinking ...
user avatar
1 vote
1 answer
47 views

Could affine transformation mod 2^128 be a side-channel attack problem

DFC cipher uses affine transformations mod $2^{64}+13$. Soon after DFC's publication, Ian Harvey raised the concern that reduction modulo a 65-bit number was beyond the native capabilities of most ...
user avatar
  • 959
0 votes
0 answers
53 views

Why does Montgomery Ladder not work for Brainpool curves

According to SafeCurves, the Brainpool curves mentioned there (P256t1 and P384t1) do not support the Montgomery Ladder for scalar multiplication in constant time. I am wondering why this is the case ...
user avatar
  • 2,458
1 vote
0 answers
31 views

Does Argon2id provide less protection against side-channel attacks than Argon2i theoretically and/or practically? [duplicate]

LUKS 2 encryption uses Argon2i as the default PBKDF. As the key is used on each access, I guess side-channel attacks are a significant threat factor. However, as I'm not a cryptographer, I am not ...
user avatar
2 votes
1 answer
136 views

How to express difficulty of breaking crypto when writing?

When writing for both technical and non-technical readers I find my self naturally wanting to write things such as : "..therefore it would be impossible to decrypt the data." When trying ...
user avatar
  • 21
0 votes
1 answer
72 views

Are side-channels possible in KDFs

Are KDFs such as PKDF2 and HKDF vulnerable to side-channel attacks such as static and dynamic power analysis including the hash type used internally?
user avatar
  • 33
5 votes
1 answer
593 views

What is the Lord of the Ring(s): Side Channel Attack and What are the results

A recent Paper to appear on USENIX Security 2021 titled as Lord of the Ring(s): Side Channel Attacks on the CPU On-Chip Ring Interconnect Are Practical by Riccardo Paccagnella Licheng Luo Christopher ...
user avatar
  • 43.1k
1 vote
1 answer
89 views

Is this constant-time comparison secure?

I was thinking about constant-time comparison and how it differs from "==", when I thought of a simple way that's could be constant-time. Being a beginner in cryptography, I'd like to know ...
user avatar
  • 421
4 votes
0 answers
342 views

secp256k1 scalar decomposing and prime field arithmetic

I'm currently studying the elliptic curve secp256k1 implementation. In my understanding, it has efficiently computable endomorphisms: We can find out a pair of number $\lambda$ and $\beta$ from the ...
user avatar
  • 61
2 votes
0 answers
70 views

Is this "AND" implementation safe against side channel attacks?

I found out that the following is a working implementation of calculating an AND function between XOR masked shares, implementation at Github. It works by calculating parities, whose terms cancel each ...
user avatar
4 votes
2 answers
928 views

Side-Channel Attacks in the Cloud

Let's say we have some very sensitive personal files. At all costs, we do not want any other pair of eyeballs to gaze upon them. We need these sensitive files to be secure and available. So, we have ...
user avatar
  • 3,057
1 vote
0 answers
82 views

Dragonfly masked DH

I was looking at Dragonfly key exchange protocol RFC 7664, and it seems to make use of masked Diffie-Hellman in the final part. Generating two random numbers less than group order $q$, $m$, and $r$ ...
user avatar
2 votes
1 answer
134 views

Constant Time algorithms for $\mathbb{Z}/m\mathbb{Z}$, $\mathbb{Z}/m\mathbb{Z}[x]$, and $\mathbb{Z}/m\mathbb{Z}[x] / (f(x))$?

I want to implement some (lattice based) protocols to better familiarize myself with a programming language (Rust). These tend to do arithmetic over rings like $\mathbb{Z}/m\mathbb{Z}$, or "...
user avatar
  • 8,424
10 votes
2 answers
944 views

What is a "constant time" work around when dealing with the point at infinity for prime curves?

I've been working for some time, on designing a constant time solution for dealing with the "point at infinity" for prime curves. So, far I'm using the Standard Projective Coordinates for ...
user avatar
3 votes
0 answers
101 views

Constant time arithmetic implementation in DSA

I am trying to understand why it is a hard problem to have formally verified constant time arithmetic for DSA when compared with ECDSA. For instance, in ECDSA implementations of OpenSSL, we have ...
user avatar
  • 31
1 vote
0 answers
60 views

Hashing of variable-length chunked data leading to leakage of secret key from side channel?

Hypothetically, secret data could be hashed in some schemes in one way or another. Could chunking of the data lead to exposure of secret component through side channel? Say converting a randomized ...
user avatar
  • 6,551
2 votes
1 answer
76 views

Why shouldn't cryptocurrency hash algorythms, resist side channel attack?

2015's Argon2 publication suggests that cryptocurrency hashing like password hashing on backend servers should not be subject to side-channel attack: Argon2d is optimized for settings where the ...
user avatar
1 vote
2 answers
90 views

Side channel attack - execution time depends on the size of the key

In my algorith execution time depends on the size of the key. It is a linear relationship (probably). The larger the key, the longer the algorithm takes to run. I have a code in Python so far. For ...
user avatar
  • 959
0 votes
1 answer
84 views

Stream slicing operation in block cipher and side-channel attack

My symmetric block cipher works kind of like a stream cipher, but it works on $128$-bit blocks. It generates a $128$-bit block in every round. And at the end of the round, I have to slice it into two ...
user avatar
  • 959
2 votes
0 answers
137 views

Is "double-and-add-always" a good mitigation against side channel attacks?

In Discrete Log based Cryptography, one of the core operations that one, has to perform is modulo exponentiation. There are many algorithms to choose from, especially, when considering my point of ...
user avatar
3 votes
1 answer
213 views

Have crypto side-channel attacks happened in the wild?

I'm aware of attacks extracting information via timing and volume. But none that care or attack the actual cryptographic algorithm implementation or end up extracting the key. Seeking examples if any ...
user avatar
  • 10.4k
-1 votes
2 answers
255 views

Will OTP provide quantum resistance under 5 conditions?

We already have quantum computing, but when quantum computing becomes commercially available there is a problem for many but not all encryption algorithm. The One-Time-Pad or OTP is the one and only ...
user avatar
  • 11
1 vote
0 answers
27 views

How to find the output shares of first-order threshold implementation of cubic degree function?

Assume $d=abc$ and to implement first order threshold implementation , the minimum input and output shares are 4 (1*3+1) , and 4 , calculated using ${4\choose 3}$ , Theorem 2. The new TI ...
user avatar
  • 1,980
0 votes
1 answer
67 views

Shuffling: Purpose and formal definition

To my understanding, shuffling means simply to permute the elements in vector $\mathbf{v}$ pseudorandomly, using a PRP $\pi (\mathrm{seed},\mathbf{v})$. A secure PRP should yield a permutation ...
user avatar
  • 327
7 votes
1 answer
91 views

What quality of randomness is needed for randomized side channel countermeasures?

Using per-operation randomness is a popular and effective way to protect cryptographic implementations against side-channel attacks, e.g. using Shuffling (randomizing the processing order eg for AES ...
user avatar
  • 44.6k
8 votes
2 answers
687 views

Constant time multiplication in GF(2^8)

I am trying to implement AES in C; I would like to make it resistant to side-channel attacks but I can't implement the multiplication in constant time. My current code: ...
user avatar
7 votes
0 answers
219 views

How to implement arbitrary s-box in a side-channel-free way in C?

This could be a question for CodeReview.SE, but I thought it might require non-trivial cryptographic knowledge to merit it on-topic here. The C language is chosen as it's a common language for ...
user avatar
  • 6,551
1 vote
0 answers
97 views

How vulnerable are SIMD operations to side channel attacks?

For a while, I was experimenting with optimization of several crypto implementations with SIMD (Single Instruction Multiple Data ) made available by C compiler ...
user avatar
13 votes
1 answer
2k views

Safely sorting secret data

Suppose you have a secret list of n distinct integers. How would you sort this list in a way that is not vulnerable to timing attacks? I tried looking up "...
user avatar
2 votes
1 answer
319 views

Is AES without T-Tables nor S-Box resistant to side-channel?

T-Tables and S-Boxes are prone to side-channel attacks, is an implementation without any lookup tables resistant to side-channel ? In this answer, https://crypto.stackexchange.com/a/63520/80926, the ...
user avatar
1 vote
1 answer
280 views

Is AES S-Box resistant to side-channel attacks?

I know that implemntations with T-tables such as Golang's are prone to side-channel attacks, but is AES's S-Box wihtout any additional table also insecure ?
user avatar