Questions tagged [side-channel-attack]
attacks using information leaked by implementations of cryptographic algorithms to obtain information about keys or (plaintext) data, instead of (or additional to) using cryptographic weaknesses.
209
questions
5
votes
2
answers
101
views
How to prevent power analysis on software level?
When attacking RSA with Square&Multiply, one can figure out the secret key by looking at the exponentiation algorithm itself. To prevent this in software, we could use dummy multiplications after ...
- 51
1
vote
1
answer
63
views
Constant-time decompression on an elliptic curve
Let $E\!: y^2 = f(x)$ be an elliptic curve over a finite field $\mathbb{F}_{q}$ of odd characteristic. Consider an $\mathbb{F}_{q}$-point $P = (x,y)$ on $E$. Suppose that we only have the $x$-...
- 355
1
vote
0
answers
55
views
Issue with understanding Side Channel Attacks
I am currently working on Side Channel Attacks (SCA) on Kyber and Dilithium. I have found myself quite confused with side channel, because so much is mentionned all the time.
For instance, I don't ...
- 21
0
votes
0
answers
26
views
Difference between Decryption-failure and Plaintext-checking oracles
I am reading this paper, which in the introduction, tells about two main types of key recovery SCAs :
Reaction_type SCAs, which uses a decryption failure oracle
Message-recovery-type SCAs, which uses ...
- 21
1
vote
1
answer
79
views
Are you aware of cryptographic contexts (e.g., post-quantum) in which a square root $\sqrt{\cdot}$ must be computed in constant time?
Let $\mathbb{F}_q$ be a finite field of odd characteristic. I know that a constant-time implementation of the square root extraction $\sqrt{\cdot} \in \mathbb{F}_q$ is used in the context of hashing ...
- 355
2
votes
1
answer
62
views
why sbox input XOR sbox output can be sensitive data of side channel attack?
As several intermediate values are used as sentive data for side channel analysis (DPA), I don't understand why sbox input ^ sbox output is also wide-used and effective.
This value does not applied in ...
- 21
0
votes
1
answer
35
views
Fan et al. Recovering MSD's
I have been trying to understand the method of recovering the MSD of the nonce proposed by Fan et al. (section 4.2), in their attack targeting wNAF implementation for scalar multiplication in the ...
- 23
0
votes
0
answers
32
views
Mitigating side-channel attacks: which is better? Masked cryptography or differential power analysis-resistant cryptography?
As part of mitigating side-channel attacks, which is the most efficient? Masked cryptography or differential power analysis-resistant cryptography? Or are they both similar?
- 2,207
1
vote
1
answer
56
views
How new cache designs stop cache-based side channel attacks
How do new cache designs aid in defending against cache-based side-channel attacks?
While conducting a side-channel attack, we have the T-table/S-virtual box's address.
Normally, address mapping is ...
- 31
2
votes
1
answer
124
views
Generic attack on Hmac sha256
Is there any generic attack on HMAC SHA 256 ?
I am currently reading up on attacks on Hmac sha-256. However most of the papers I've found are about side channel attacks such as Differential power ...
- 33
0
votes
0
answers
82
views
How to get dp and dq of CRT-RSA?
I am learning to utilize flush+reload method to get private key of CRT-RSA.
CRT-RSA calculates two parts separately: mp = c^dp mod p and ...
- 101
6
votes
3
answers
3k
views
What do you call a random number that affects the calculation, but not the result?
This is about the same random ladder algorithm as my previous question. It computes f(g,n,r)=n*g or g^n (depending on the group notation), where g is a generator of a group. Suppose n=5882353. This ...
- 201
2
votes
2
answers
167
views
How do I try a timing attack on a public-key implementation on a general-purpose computer?
I'm writing a higher-order function in Haskell for use in public-key algorithms; it works equally well for RSA or elliptic curves. I'd like to test it for susceptibility to side channel attacks. How ...
- 201
6
votes
0
answers
165
views
Are side-channels a concern for AEAD key commitment fixes?
I'm currently debating whether to revert to a non-committing AEAD (ChaCha20-Poly1305) instead of a committing AEAD based on Encrypt-then-MAC (XChaCha20-BLAKE2b) for stream encryption. Borg backup made ...
- 1,208
0
votes
1
answer
72
views
Constant time empty string validation
Checks for null require an == check. If you have a string secret (say a hex-encoded key) and you want to check it's empty for validation should you compare it to <...
8
votes
2
answers
279
views
Is the elliptic-curve cryptography library libsecp256k1 not susceptible to the Hertzbleed attack?
I was reading up on the recently disclosed Hertzbleed side channel attack(s).
It was speculated on Twitter that the elliptic-curve cryptography library libsecp256k1 is not susceptible to these attacks....
- 197
2
votes
1
answer
71
views
Can cryptographic accelerators along with side channel attack be used for GPS spoofing?
While having a discussion with someone on a forum about GPS spoofing, he mentioned that GPS signal can be spoofed for a cruising missile and make it land somewhere else using side-channel attack along ...
- 23
3
votes
1
answer
255
views
Correlation Power Analysis on AES - possible attack models
As far as I know it is possible to extract the key or key parts using side channel power analysis attack on AES, but we need some strong attacker model in order to do that. The first attack I know ...
- 31
2
votes
1
answer
103
views
Pros and cons about padding a cryptogram produced with an "additive" operation mode
These days I found myself thinking about the implications of padding or not padding block cipher modes that act like additive stream ciphers (I meant OFB, CTR, GCM etc). Let's call additive modes.
You ...
- 23
0
votes
0
answers
65
views
RSA private key revealing by decrypting c=n-1
In RSA, if we use Square and always Multiply algorithm in decryption, how does decrypting the ciphertext $c=n-1$, while our public key is $(n,e)$, cause the private key $d$ to reveal due to side-...
0
votes
0
answers
71
views
Masked RSA/BigInt Arithmetic?
Masking is the process of replacing operations (internally to some cryptographic algorithm) on intermediate values with operations on secret shared values. Then, even if some number of these secret-...
- 10.8k
0
votes
1
answer
201
views
Is CBC mode of encryption still safe as long as it's not use to send messages over a network?
I'm still reading about the Padding Oracle attack and Side Channel attack that can be performed to decrypt cipher text encrypted with CBC though it's still not clear to me.
But base on my little ...
- 105
1
vote
1
answer
241
views
Timing attacks: Symmetric vs Asymmetric Algorithms
There is a statement that I can't give a reference;
"Since the timing characteristics of symmetric algorithms are not as key dependent as asymmetric algorithms, they are more resistant against ...
- 500
1
vote
1
answer
393
views
Is it okay to avoid a plaintext IV in AES?
The scenario
Using AES 256 with CBC mode. (Authentication is done separately. Ignored here.)
The goal (explained more later)
To avoid sending an unencrypted IV.
But since this is being done using .NET ...
- 1,965
2
votes
1
answer
143
views
What is reaction attack?
In the paper of "Reaction Attacks against Several Public-Key Cryptosystems" CiteSeerX link, reaction attack is defined informally as "Obtaining information about the private key or ...
- 500
5
votes
2
answers
775
views
Post-quantum algorithms and side channel attacks
I am studying finalist algorithms of NIST Post-Quantum Cryptography Standardization. I noticed that almost all third party cryptanalysis papers consist of side-channel attacks. Why are classical ...
- 500
2
votes
1
answer
65
views
Threshold implementation of ciphers
What is the principle behind threshold implementation of block ciphers and how is this protecting against side channel attacks?
- 1,068
3
votes
2
answers
172
views
Protecting AES via Shamir Secret Sharing
This is about the paper Protecting AES with Shamir's Secret Sharing Scheme by Louis Goubin and Ange Martinelli which describes how to use Shamir Secret Sharing to obtain masked implementations of AES.
...
- 131
1
vote
0
answers
135
views
How is the Argon2d side channel attack performed?
How should the adversary behave in order to perform a successful side channel attack against Argon2d?
I'm trying to understand the scenario that Argon2i tries to resist against.
- 553
1
vote
1
answer
58
views
What are the security implications of RSA decryption of ciphertext >= modulus?
While reading through the sections about decryption in PKCS#1 v2.2, I noticed that the decryption algorithms are required to output the failure symbol: ...
- 8,263
2
votes
0
answers
63
views
Randomization of ECDSA signing operations to prevent SCA
A large number of SCA papers that talk about ECDSA mention the need for blinding/randomisation of the signing process, typically with a single-sentence comment about replacing the projective ...
- 357
1
vote
1
answer
142
views
How feasible is it to guess the private key of libsodium by taking into account generation time?
So suppose you are doing this locally (so no network noise), and know the exact specifics of your processor too. Is it feasible to figure out the private key (while having access to the public-key) ...
- 709
2
votes
1
answer
71
views
Role of AND operation in Side Channel Security
I was going through a side channel protection. It seems in the 3-shares (Appendix A) or 4-shares (Appendix B) has some computations that grows with the number of AND operations.
My question: Is there ...
- 593
1
vote
1
answer
52
views
Could affine transformation mod 2^128 be a side-channel attack problem
DFC cipher uses affine transformations mod $2^{64}+13$. Soon after DFC's publication, Ian Harvey raised the concern that reduction modulo a 65-bit number was beyond the native capabilities of most ...
- 1,181
0
votes
0
answers
92
views
Why does Montgomery Ladder not work for Brainpool curves
According to SafeCurves, the Brainpool curves mentioned there (P256t1 and P384t1) do not support the Montgomery Ladder for scalar multiplication in constant time.
I am wondering
why this is the case
...
- 2,508
2
votes
0
answers
39
views
Does Argon2id provide less protection against side-channel attacks than Argon2i theoretically and/or practically? [duplicate]
LUKS 2 encryption uses Argon2i as the default PBKDF. As the key is used on each access, I guess side-channel attacks are a significant threat factor. However, as I'm not a cryptographer, I am not ...
- 21
2
votes
1
answer
136
views
How to express difficulty of breaking crypto when writing?
When writing for both technical and non-technical readers I find my self naturally wanting to write things such as :
"..therefore it would be impossible to decrypt the data."
When trying ...
- 21
1
vote
1
answer
105
views
Are side-channels possible in KDFs
Are KDFs such as PKDF2 and HKDF vulnerable to side-channel attacks such as static and dynamic power analysis including the hash type used internally?
- 43
5
votes
1
answer
620
views
What is the Lord of the Ring(s): Side Channel Attack and What are the results
A recent Paper to appear on USENIX Security 2021 titled as
Lord of the Ring(s): Side Channel Attacks on the CPU On-Chip Ring Interconnect Are Practical by Riccardo Paccagnella Licheng Luo Christopher ...
- 46k
1
vote
1
answer
132
views
Is this constant-time comparison secure?
I was thinking about constant-time comparison and how it differs from "==", when I thought of a simple way that's could be constant-time. Being a beginner in cryptography, I'd like to know ...
- 421
4
votes
0
answers
609
views
secp256k1 scalar decomposing and prime field arithmetic
I'm currently studying the elliptic curve secp256k1 implementation.
In my understanding, it has efficiently computable endomorphisms:
We can find out a pair of number $\lambda$ and $\beta$ from the ...
- 61
2
votes
0
answers
73
views
Is this "AND" implementation safe against side channel attacks?
I found out that the following is a working implementation of calculating an AND function between XOR masked shares, implementation at Github. It works by calculating parities, whose terms cancel each ...
- 37
4
votes
2
answers
1k
views
Side-Channel Attacks in the Cloud
Let's say we have some very sensitive personal files. At all costs, we do not want any other pair of eyeballs to gaze upon them. We need these sensitive files to be secure and available.
So, we have ...
- 3,092
1
vote
0
answers
100
views
Dragonfly masked DH
I was looking at Dragonfly key exchange protocol RFC 7664, and it seems to make use of masked Diffie-Hellman in the final part. Generating two random numbers less than group order $q$, $m$, and $r$ ...
- 561
2
votes
1
answer
141
views
Constant Time algorithms for $\mathbb{Z}/m\mathbb{Z}$, $\mathbb{Z}/m\mathbb{Z}[x]$, and $\mathbb{Z}/m\mathbb{Z}[x] / (f(x))$?
I want to implement some (lattice based) protocols to better familiarize myself with a programming language (Rust). These tend to do arithmetic over rings like $\mathbb{Z}/m\mathbb{Z}$, or "...
- 10.8k
10
votes
2
answers
1k
views
What is a "constant time" work around when dealing with the point at infinity for prime curves?
I've been working for some time, on designing a constant time solution for dealing with the "point at infinity" for prime curves. So, far I'm using the Standard Projective Coordinates for ...
- 978
3
votes
0
answers
125
views
Constant time arithmetic implementation in DSA
I am trying to understand why it is a hard problem to have formally verified constant time arithmetic for DSA when compared with ECDSA. For instance, in ECDSA implementations of OpenSSL, we have ...
- 31
1
vote
0
answers
73
views
Hashing of variable-length chunked data leading to leakage of secret key from side channel?
Hypothetically, secret data could be hashed in some schemes in one way or another. Could chunking of the data lead to exposure of secret component through side channel?
Say converting a randomized ...
- 8,263
2
votes
1
answer
86
views
Why shouldn't cryptocurrency hash algorythms, resist side channel attack?
2015's Argon2 publication suggests that cryptocurrency hashing like password hashing on backend servers should not be subject to side-channel attack:
Argon2d is optimized for settings where the ...
- 123
1
vote
2
answers
110
views
Side channel attack - execution time depends on the size of the key
In my algorith execution time depends on the size of the key. It is a linear relationship (probably). The larger the key, the longer the algorithm takes to run. I have a code in Python so far.
For ...
- 1,181