Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [side-channel-attack]

attacks using information leaked by implementations of cryptographic algorithms to obtain information about keys or (plaintext) data, instead of (or additional to) using cryptographic weaknesses.

2
votes
1answer
73 views

Fault attacks inside a loop

I am working on an attack that involves changing a constant inside a loop. Consider the simplified example is as below, ...
4
votes
0answers
45 views

Why is it safe to generate the secret key and masking vectors using rejection sampling in CRYSTALS-Dilithium?

In CRYSTALS-Dilithium module lattice-based digital signatures, the secret key vectors $s_1, s_2$ with coefficients in $[-\eta, \eta]$ and the signature masking vector $y$ with coefficients in $(-\...
2
votes
0answers
28 views

RSA: Blinding versus fixed-time computation

For RSA, what is the standard solution against timing attacks? I know about RSA blinding as one solution. Another solution is to always compute both the squared value and square-and-multiply values, ...
0
votes
1answer
44 views

Caculating Correlation for CPA attack on AES

I am having some trouble understanding how to calculate the correlation coefficient for CPA attack on AES. In the article Study of Deep Learning Techniques for Side-Channel Analysis and Introduction ...
6
votes
1answer
151 views

Does a masked look-up table prevent cache timing attacks?

When applying the boolean masking countermeasure to a cipher which uses an S-box $S$, a way to handle this nonlinear operation is to recompute a new S-box $S'$ such that $S'(x \oplus r_{in}) = S(x) \...
0
votes
1answer
39 views

What is the purpose of multiple key addition layers in AES?

I understand the purpose of the SubBytes layer (confusion) and the ShiftRows and MixColumns layers (diffusion). But I don't see the purpose of having more than one key addition layer. What I've been ...
2
votes
0answers
69 views

AES-128 8th round bit fault propagation

It's well known that by injecting a byte fault during the 8th round of AES 128 just before the mix column the key can be recovered with $2^{32}$-key space. A brute force attack is then possible but ...
18
votes
1answer
897 views

If a single bit was known through all states in AES, which would cause the most information to leak?

This question is motivated by some bad Verilog. Due to someone being sloppy with port assignments and a output statement, I have an AES core that has a single-bit from a S-Box in the key schedule ...
2
votes
1answer
79 views

Attacks on one-time pad, given a property of keys

An adversary $A$, eavesdrops $n$ cipher-texts, $c_{1}, c_{2} ..., c{_n}$. It also knows a value $v$ and a function $f$ such that $$f(k_{1}, k_{2}, ..., k_{n}) = v$$ where, $k_{i}$ is used to encrypt $...
2
votes
2answers
46 views

Does side-channel attacks offer any difficulty to Stinson's concept of `provable security'?

Here's a quote from Douglas Stinson: “[i]f a cryptosystem can be ‘broken’ in some specific way, then it would be possible to efficiently solve some well-studied problem that is thought to be ...
2
votes
1answer
56 views

Statistical (innefective) Fault Attacks on DES

I read this paper: Exploiting Ineffective Fault Inductions on Symmetric Cryptography. I was wondering if the same idea is applicable for DES. I know both algorithms are symmetric but the idea is not ...
2
votes
1answer
100 views

Timing Side Channel on error-correcting code

This question may be a basic question but it is not clear to me at the moment. I have an Error Correcting Code (ECC) in a key-encapsulation scheme designed for post-quantum cryptography which ...
8
votes
2answers
2k views

How to avoid side channel attacks when handling large numbers?

For cryptography, the platforms have limited size as 32 or 64-bit operations. We definitely need big numbers to implement the encryption/decryption and digital signatures for cryptosystems like RSA, ...
2
votes
1answer
223 views

Fault attack on RSA-CRT

I am trying to understand fault attack on RSA-CRT, and I found some example, which I don't know how to solve it. I know public modulus $N$, public exponent $e$, a value of faulty signature (where ...
2
votes
0answers
184 views

RSA most significant bit oracle attack

I have been reading up on RSA attacks and came across a problem that could be called a most-significant-bit (MSB) oracle attack. For the sake of clarity, let's define RSA primes $(p, q)$, private key ...
4
votes
0answers
109 views

Why are matrices so common in symmetric encryption?

Matrices have been used in symmetric ciphers since the Hill Cipher (before?) all the way up to modern ciphers such as Twofish and AES. I understand matrices can be invertible, therefore making them ...
2
votes
1answer
139 views

How to Prevent Correlation Power Analysis Attack on AES?

Which techniques could be applied to AES to prevent these kind of attacks? I can just think of creating noise with a parallel process for random computation, so the signals have the combination of ...
0
votes
1answer
84 views

Regarding Lattice atttacks on ECDSA with a portion of known bits of the nonce k

I am new in the field of cryptography, and I am having some troubles understanding a concept regarding the lattice dimension needed in the attack on ECDSA using several messages with L known bits of ...
-1
votes
2answers
423 views

side channel attack on RSA

A side-channel attack is any attack based on information gained from the implementation of Encryption protocol and by monitoring security-critical operations. Almost every encryption had a side-...
2
votes
0answers
39 views

How do we perform second order differential power analysis attack?

I have read papers which describe that the power traces(acquired from a side channel resistant implementation like masking) need to be centered and squared, then a correlation needs to be performed ...
8
votes
1answer
172 views

Can the lengths of HTTPS requests be used to deduce which public pages on a site are visited?

I thought of this recently: There are some websites which have many publicly accessible pages, some of which could be embarrassing despite being public (e.g. Wikipedia). The HTML for these pages also ...
1
vote
1answer
63 views

Montgomery Powering Ladder and Side Channel Attacks: Is it practically (im-)possible to analyze where intermediate values are stored?

The Montgomery Powering Ladder performs an exponentiation with the operations square and multiply (called double and add in the case of elliptic curves). To my knowledge the order and kind of ...
3
votes
2answers
190 views

Why does side-channel security focus on “shielding” rather than “jamming”?

I have always found it weird when in a crypto discussion people stressed the importance of making algorithms runtime-deterministic, to the point of avoiding any compiler optimisations. To me, it ...
2
votes
1answer
105 views

Side-Channel attack on RSA decryption using comparison result with p,q?

I was pointed to whether we could learn the secret key of RSA by repeatedly using following side channel: We assume that there exists a side channel in RSA decryption using CRT that, if the most-...
4
votes
4answers
202 views

Mitigating Side Channel Attack (SCA)

The SCA power attack described in 2016 article called "Power Side Channels in Security ICs: Hardware Countermeasures", depends on the measurement of power consumption fluctuations during AES-128 ...
0
votes
0answers
42 views

(Side channel) attack on a PIC18 micro controller

I'm trying to get some practical experience on (side channel) attacks. First I want to note all possible vulnerabilities. I thought about: Preset I have physical access and I own/wrote the software, ...
1
vote
1answer
47 views

Side Channel Analysis (CorrPA), comparison between HW-results and measured power traces

I think I have missed something very fundamental. I am trying to understand the step in DPA where you compare your hypothetical power consumptions with your measured ones. The Matrix H with Matrix T. ...
1
vote
2answers
396 views

Constant time implementations of crypto algorithms

To protect against cache attacks (side channel attacks) generally constant time crypto implementations are advised. In some cases DJB released new algorithms (chacha) that are designed with this in ...
1
vote
0answers
118 views

AES Fault Attack

Induce random fault (non-zero) error in one byte before MixColumns in Round 9 I get last round key with 32 bit (4 bytes) missing (Missing are bytes 1, 8, 11, 14) How can I recover these key bytes ...
6
votes
1answer
387 views

Does blinding work against side channel on RSA?

In the so called "blinding" technique for RSA, prior to decryption, the ciphertext is multiplied by random $r$ raised to the power of $e$; e.g., $C$ is replaced with $C\cdot r^e$; and then after ...
0
votes
1answer
180 views

S-box and Side Channel Attacks

S-boxes with non-linearity greater than 112 are considered prone to side channel attacks. If a non-linear S- box with non- linearity greater than 112 (excluding bent functions with non-linearity of ...
6
votes
3answers
606 views

Why don't table lookups run in constant time?

The Wikipedia article on big O notation says that performing a lookup is a constant time operation. So why are lookup tables susceptible to timing attacks?
7
votes
1answer
96 views

Is the context of “constant time” algorithms inclusive when you have a clock control?

There is generally a push to make algorithms and components constant time to be resistance to side channel attacks. For instance, AES-NI instructions take as many cycles as rounds; however, I can ...
1
vote
0answers
32 views

Randomness in Trichina's secure AND operation

In this paper, Elena Trichina introduces a way to compute a masked AND operation. The principle is the following: Having two operands $a$ and $b$ masked with random boolean shares $x$ and $y$ ($\...
8
votes
1answer
380 views

Do people not care about side channel resistance?

Recently, I have been browsing a lot through libraries that implementing Shamir secret sharing. I see a lot of code that implements this cryptographic algorithm without any side channel (timing/branch/...
2
votes
1answer
241 views

AES: a question about dual ciphers and security

I have recently learned of dual ciphers, in particular dual ciphers of AES. It seems there are many. Most of my information comes from:(1) Representations and Rijndael Descriptions. In this paper the ...
7
votes
3answers
333 views

Are there any symptoms of a side channel attack on the target chip?

I would like to know if there are some symptoms that let me detect if my integrated circuit is actually subject to a side channel attack. For example, are the following potential indicators? ...
0
votes
1answer
165 views

SPA resistant RSA trace

I am trying to perform simple power analysis on RSA. In particular focusing the modular exponentiation module and for this I have implemented left-to-right variant of binary exponentiation. pseudo ...
6
votes
2answers
444 views

RSA Timing Attack on “Extra” Montgomery Reduction

In "A practical implementation of the timing attack", the authors take advantage of a timing difference that stems from "extra reductions" that occur when multiplying numbers in the Montgomery form. ...
8
votes
1answer
304 views

Deterministic RSA blinding

I have an implementation of the RSA private key operation in a context where I don't have access to an entropy source. I'd like to add blinding to it (both message and exponent), to make it resist ...
1
vote
0answers
226 views

Cracking a key using a combination of partial keys

As part of a cryptanalytic attack I've carried out, I used a divide-and-conquer strategy to divide the secret key $k$ into several equal-sized partial keys $k = {k_1, k_2, ...}$. The attack works ...
4
votes
1answer
293 views

Dilithium signature scheme and timing attacks – Does the running time actually depend on the secret key?

The paper “CRYSTALS – Dilithium: Digital Signatures from Module Lattices” (by Léo Ducas, Tancrède Lepoint, Vadim Lyubashevsky, Peter Schwabe, Gregor Seiler, and Damien Stehlé) introduces a digital ...
1
vote
1answer
75 views

Scenario for applying power analysis

I have started doing some reading about power analysis (SPA, DPA), and it is not clear to me in what Scenario one would have to fear such an attack. It appears to me that a typical situation is ...
1
vote
2answers
206 views

Sliding windows implementation (Exponentiation by squaring)

I am conducting a research on cpu-cache based info leak caused by using Sliding window in the diffie helman key exchange. For my research I am looking for a real-world implementation of sliding ...
16
votes
2answers
1k views

Can deterministic ECDSA be protected against fault attacks?

In a paper by Barenghi and Pelosi, it was described that fault attacks could be used to derive the secret key when using deterministic ECDSA as described in RFC6979 by @Thomas_Pornin Deterministic (...
0
votes
1answer
77 views

How many AES-operationes have to be watched for key-exploit by side channel attacks?

if I would like to exploit a used key by the side channel attack, where you measure electromagnetic fields, how many runs of the AES-128 do I need to spy for a successful exploit? I can't use any ...
21
votes
1answer
6k views

Why use argon2i or argon2d if argon2id exists?

So I am currently working on a github project of mine and I want to implement Argon2 . The Problem is that I dont really know a lot about it . Internet research is not really helpful , because Argon2 ...
25
votes
5answers
3k views

Timing-Safety in JVM-Languages

How is it possible to write timing-safe code in JVM-languages (Java, Scala, Clojure...)? Is it possible to make libraries like BouncyCastle safe against timing-attacks? I know that even in C it is ...
8
votes
1answer
2k views

Is ChaCha20 safer than AES with respect to side-channel attacks?

I've already seen some topics on this matter, but I feel like my question hasn't really been answered. Given the following: AES must be implemented in hardware (i.e. using the AES-NI instruction set)...
3
votes
1answer
735 views

What is the difference between perfoming Correlation Power Analysis (CPA) in the first AES round and doing it in the last round?

I have a script that helps me to make to make a Correlation Power Analysis (CPA) attack. I am trying to attack the first round. As input, I put: my traces my plaintexts my key The steps to make the ...