Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [side-channel-attack]

attacks using information leaked by implementations of cryptographic algorithms to obtain information about keys or (plaintext) data, instead of (or additional to) using cryptographic weaknesses.

10
votes
1answer
3k views

AES timing attacks

I'm just interested in cryptography, so please don't expect me to be an expert. ;) I recently read about AES cache timing attacks and found it very interesting. I read the article Cache-timing attacks ...
27
votes
3answers
6k views

How practical are side-channel attacks and how much of a concern are they?

I see a lot of research in very sophisticated side-channel attacks on crypto systems. Most (but definitely not all) seem to follow a trend, namely, the crypto system does something very dumb like ...
32
votes
2answers
21k views

Practical disadvantages of GCM mode encryption

It seems that GCM mode encryption has a clear advantage over CBC + HMAC in the sense that it only requires a single key. But it seems that there are some experts here that do not trust it enough to ...
21
votes
3answers
4k views

Known methods for constant time (table-free) AES implementation using 'standard' operations?

There are several known methods for implementing AES in constant time using SIMD operations, mostly based around fast byte shuffling (for instance Hamburg and Kasper/Schwabe). Are there any similar ...
16
votes
2answers
6k views

RSA least significant bit oracle attack

I have been reading up on RSA attacks and came across one that could be called a least-significant-bit (LSB) oracle attack. For the sake of clarity lets define RSA primes $(p, q)$, private key $d$ ...
7
votes
3answers
468 views

Why should we consider the output of the AES s-box as a “sensitive value” in relation to side channel attacks?

In general, we consider the output of s-box in AES as a “sensitive value” in order to perform a side channel attack. I would be very grateful if you could explain to me the reason of that ...
5
votes
2answers
1k views

Timing attack on modular exponentiation

It is known that computing $a^x \bmod N$ takes $O(|x| + \mathrm{pop}(x))$ multiplications modulo $N$, where $|x|$ is the number of bits of $x$ and $\mathrm{pop}(x)$ is the number of $1$ bits (Hamming ...
9
votes
1answer
3k views

What is “Blinding” used for in cryptography?

What does "blinding" mean in cryptography, and where do we usually use it? Can you describe a sample implementation?
6
votes
3answers
924 views

Is there a cryptographic algorithm which is immune to side channel attacks?

Is there any cryptographic algorithm immune to side channel attacks based on scan chain? In VLSI point of view.
21
votes
1answer
6k views

Why use argon2i or argon2d if argon2id exists?

So I am currently working on a github project of mine and I want to implement Argon2 . The Problem is that I dont really know a lot about it . Internet research is not really helpful , because Argon2 ...
12
votes
1answer
2k views

Why do crypto libs use table lookups when they're vulnerable to timing attacks?

AESEngine.java, from BouncyCastle, uses table lookups as does aes_x86core.c, in OpenSSL. But per Cache-timing attacks on AES table lookups like what OpenSSL and BouncyCastle are doing are vulnerable ...
8
votes
2answers
1k views

Why are side channel attacks such as SPA/DPA/ CPA based on the AES SubBytes routine?

I have three questions about AES related to side channel attacks: Why are side channel attacks such as CPA related to the non-linearity of the SubBytes routine within AES? What is the difference ...
5
votes
1answer
2k views

Montgomery Ladder vs Double-and-Add

I would like to know what (if any) are the advantages of using Montgomery Power ladder over the Double-and-Add-Always algorithm. I think that firstly, Monty would be slightly faster than DoubleAndAdd. ...
4
votes
3answers
440 views

Attack against modular inversion operation using side-channels?

I'm building a device that performs a modular inversions using a secret modulus. I would like to know if it is possible to recover all or part of this modulus by side-channels (timing, power, EMR, etc....
11
votes
1answer
936 views

Is it possible to test implementation for side-channel attacks?

When it comes to implementing cryptographic algorithms, there seems to be a big focus on the difficulty of doing so without introducing the potential for side channel attacks and the knowledge ...
6
votes
3answers
626 views

Why don't table lookups run in constant time?

The Wikipedia article on big O notation says that performing a lookup is a constant time operation. So why are lookup tables susceptible to timing attacks?
1
vote
1answer
981 views

Defence against timing attacks

I know this is a difficult subject but would a good defense against timing attacks be not sending a message if the decryption or authentication fails? So if the attacker provides a wrong HMAC for ...
8
votes
2answers
411 views

Conditions for a successful Differential Power Analysis attack

From this paper, there are two conditions for a successful DPA attack: i) there exists an intermediate variable in the implementation that is correlated with the power consumption and ii) ...
6
votes
2answers
942 views

Cryptanalysis and weaknesses of SEED cipher

I've discovered that a client has SEED enabled in their SSL ciphers, and would like to know a bit more about it from a security perspective. The Wikipedia article doesn't mention any flaws, yet I've ...
5
votes
1answer
569 views

How can bit slicing be constant time, when Mix Columns is in the cipher

I'm reading about bit-slicing techniques, and one thing about it caught my mind. The strength with bit sliced implementations are (apart from that they are fast) that they are running in constant ...
4
votes
1answer
329 views

ChaCha20 immune to timing attacks

What are the reasons because of which ChaCha20 is immune to timing attacks ? Also why is not AES immune to timing attacks?
3
votes
1answer
755 views

What is the difference between perfoming Correlation Power Analysis (CPA) in the first AES round and doing it in the last round?

I have a script that helps me to make to make a Correlation Power Analysis (CPA) attack. I am trying to attack the first round. As input, I put: my traces my plaintexts my key The steps to make the ...
2
votes
1answer
244 views

AES: a question about dual ciphers and security

I have recently learned of dual ciphers, in particular dual ciphers of AES. It seems there are many. Most of my information comes from:(1) Representations and Rijndael Descriptions. In this paper the ...