Questions tagged [side-channel-attack]

attacks using information leaked by implementations of cryptographic algorithms to obtain information about keys or (plaintext) data, instead of (or additional to) using cryptographic weaknesses.

49 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
8 votes
0 answers
155 views

Software timing attack using Kocher method

What's the minimum number of random sample points needed in Kocher's timing attack, so that we can determine enough valid measurements of $A_{i,r}$ and $D_{i,r}$? I'm working from this paper: Volker ...
alfred's user avatar
  • 83
6 votes
0 answers
227 views

Are side-channels a concern for AEAD key commitment fixes?

I'm currently debating whether to revert to a non-committing AEAD (ChaCha20-Poly1305) instead of a committing AEAD based on Encrypt-then-MAC (XChaCha20-BLAKE2b) for stream encryption. Borg backup made ...
samuel-lucas6's user avatar
5 votes
0 answers
252 views

Why is it safe to generate the secret key and masking vectors using rejection sampling in CRYSTALS-Dilithium?

In CRYSTALS-Dilithium module lattice-based digital signatures, the secret key vectors $s_1, s_2$ with coefficients in $[-\eta, \eta]$ and the signature masking vector $y$ with coefficients in $(-\...
Naruto999's user avatar
  • 436
4 votes
0 answers
98 views

Masking countermeasures for AES-GCM

Suppose I have a masked AES encryption $AES(\oplus_i K_i, \oplus_i P_i)=\oplus_i C_i$, i.e. the key, plaintext, and resulting ciphertext are tuples $K_i$, $P_i$, and $C_i$ that sum to $K$, $P$, and $C$...
yoyo's user avatar
  • 391
4 votes
0 answers
800 views

secp256k1 scalar decomposing and prime field arithmetic

I'm currently studying the elliptic curve secp256k1 implementation. In my understanding, it has efficiently computable endomorphisms: We can find out a pair of number $\lambda$ and $\beta$ from the ...
luke's user avatar
  • 61
4 votes
0 answers
202 views

Why are matrices so common in symmetric encryption?

Matrices have been used in symmetric ciphers since the Hill Cipher (before?) all the way up to modern ciphers such as Twofish and AES. I understand matrices can be invertible, therefore making them ...
Red Book 1's user avatar
  • 1,025
4 votes
1 answer
236 views

Lattice-based cryptography prone to side channel attack?

Is lattice-based cryptography still prone to side channel attacks? What are some mitigation strategies, if any?
Nathan Aw's user avatar
3 votes
0 answers
112 views

How do you securely implement a finite field?

I'm not sure if this question belongs here or to StackOverflow. Please flag it if not. I'm trying to implement a standalone library for finite field arithmetic of prime and prime power order as a way ...
tur11ng's user avatar
  • 962
3 votes
0 answers
141 views

Constant time arithmetic implementation in DSA

I am trying to understand why it is a hard problem to have formally verified constant time arithmetic for DSA when compared with ECDSA. For instance, in ECDSA implementations of OpenSSL, we have ...
sohu's user avatar
  • 31
3 votes
0 answers
130 views

Neural networks in Differential Power Analysis?

I am trying to understand how neural networks are used to do DPA, but I am having trouble understand DPA. My current understanding is that with DPA, we are just guessing one piece of a key at a time, ...
Aux's user avatar
  • 31
3 votes
1 answer
678 views

Cracking a key using a combination of partial keys

As part of a cryptanalytic attack I've carried out, I used a divide-and-conquer strategy to divide the secret key $k$ into several equal-sized partial keys $k = {k_1, k_2, ...}$. The attack works ...
Ricardo M.'s user avatar
2 votes
0 answers
75 views

Randomization of ECDSA signing operations to prevent SCA

A large number of SCA papers that talk about ECDSA mention the need for blinding/randomisation of the signing process, typically with a single-sentence comment about replacing the projective ...
Dave's user avatar
  • 357
2 votes
0 answers
74 views

Is this "AND" implementation safe against side channel attacks?

I found out that the following is a working implementation of calculating an AND function between XOR masked shares, implementation at Github. It works by calculating parities, whose terms cancel each ...
Balazs F's user avatar
2 votes
0 answers
297 views

Is "double-and-add-always" a good mitigation against side channel attacks?

In Discrete Log based Cryptography, one of the core operations that one, has to perform is modulo exponentiation. There are many algorithms to choose from, especially, when considering my point of ...
Aravind A's user avatar
  • 1,010
2 votes
0 answers
67 views

Security of bit shift in Serpent

As far I know, the Serpent cipher is the only cipher that uses legit bit shifts (<<) along with circular left shift (...
hardyrama's user avatar
  • 2,074
2 votes
0 answers
130 views

Side-channel vulnerability of AEGIS naive AES implementation

AEGIS, one of the finalists of CAESAR competition, uses a naive implementation of AES encryption round as its reference implementation. By naive I mean it uses secret dependent table lookups, so it is ...
user3368561's user avatar
2 votes
0 answers
65 views

Side Channel Attack Evaluation Methods

I am studying the SCA Evaluation method success rate, and I have a doubt regarding to it. From my understanding, to calculate success rate, first we have a pool of traces all using same key and ...
Fangtastic's user avatar
2 votes
0 answers
73 views

RSA: Blinding versus fixed-time computation

For RSA, what is the standard solution against timing attacks? I know about RSA blinding as one solution. Another solution is to always compute both the squared value and square-and-multiply values, ...
Myria's user avatar
  • 2,575
2 votes
0 answers
164 views

AES-128 8th round bit fault propagation

It's well known that by injecting a byte fault during the 8th round of AES 128 just before the mix column the key can be recovered with $2^{32}$-key space. A brute force attack is then possible but ...
Von k's user avatar
  • 33
2 votes
0 answers
2k views

RSA most significant bit oracle attack

I have been reading up on RSA attacks and came across a problem that could be called a most-significant-bit (MSB) oracle attack. For the sake of clarity, let's define RSA primes $(p, q)$, private key ...
iosmanthus's user avatar
2 votes
0 answers
74 views

How do we perform second order differential power analysis attack?

I have read papers which describe that the power traces(acquired from a side channel resistant implementation like masking) need to be centered and squared, then a correlation needs to be performed ...
ShanRe's user avatar
  • 39
2 votes
0 answers
188 views

AES-128: How to find cipherkey comparing wrong and right ciphertexts?

I have a .mat file which contains 10 plaintexts and 10 ciphertexts which are correctly encrypted with AES-128 algorithm. It also contains 10 more ciphertexts which are wrongly encrypted. The fault is ...
MPA's user avatar
  • 121
2 votes
0 answers
310 views

Side-channel attacks for ARM conditional instructions

I'm implementing some cryptographic functions on an ARM Cortex-M4 and would like to be safe against side-channel attacks, like power and timing attacks. For efficiency I'd like to use conditional ...
Emil's user avatar
  • 133
2 votes
0 answers
215 views

How many messages needs to be send to server to get AES key in Cache-timing Attack

I'm trying to evaluate the correlation between key length and the number of messages that needs to be send to server during Cache timing Attack. I read both D. Bernstein, “Cache-timing attacks on AES,...
Bartlomiej Grzeskowiak's user avatar
2 votes
1 answer
136 views

How to express difficulty of breaking crypto when writing?

When writing for both technical and non-technical readers I find my self naturally wanting to write things such as : "..therefore it would be impossible to decrypt the data." When trying ...
rlon134's user avatar
  • 21
1 vote
0 answers
41 views

Where do we put known bits of nonce when performing lattice attack on ECDSA?

I have read so many papers and posts about lattice attacks on ECDSA but none of them used an example of different MSB values for k but instead they all used fixed MSB. So here i am trying to ...
diviserbyzero's user avatar
1 vote
0 answers
77 views

Issue with understanding Side Channel Attacks

I am currently working on Side Channel Attacks (SCA) on Kyber and Dilithium. I have found myself quite confused with side channel, because so much is mentionned all the time. For instance, I don't ...
rerouille's user avatar
1 vote
0 answers
167 views

How is the Argon2d side channel attack performed?

How should the adversary behave in order to perform a successful side channel attack against Argon2d? I'm trying to understand the scenario that Argon2i tries to resist against.
caveman's user avatar
  • 573
1 vote
0 answers
109 views

Dragonfly masked DH

I was looking at Dragonfly key exchange protocol RFC 7664, and it seems to make use of masked Diffie-Hellman in the final part. Generating two random numbers less than group order $q$, $m$, and $r$ ...
Manish Adhikari's user avatar
1 vote
0 answers
73 views

Hashing of variable-length chunked data leading to leakage of secret key from side channel?

Hypothetically, secret data could be hashed in some schemes in one way or another. Could chunking of the data lead to exposure of secret component through side channel? Say converting a randomized ...
DannyNiu's user avatar
  • 9,080
1 vote
1 answer
118 views

Stream slicing operation in block cipher and side-channel attack

My symmetric block cipher works kind of like a stream cipher, but it works on $128$-bit blocks. It generates a $128$-bit block in every round. And at the end of the round, I have to slice it into two ...
Tom's user avatar
  • 1,211
1 vote
0 answers
28 views

How to find the output shares of first-order threshold implementation of cubic degree function?

Assume $d=abc$ and to implement first order threshold implementation , the minimum input and output shares are 4 (1*3+1) , and 4 , calculated using ${4\choose 3}$ , Theorem 2. The new TI ...
hardyrama's user avatar
  • 2,074
1 vote
0 answers
136 views

How vulnerable are SIMD operations to side channel attacks?

For a while, I was experimenting with optimization of several crypto implementations with SIMD (Single Instruction Multiple Data ) made available by C compiler ...
Aravind A's user avatar
  • 1,010
1 vote
0 answers
70 views

Help on Algebraic Side Channel Attacks

I am a master student in computer security, I am preparing a dissertation thesis in the theme is: Algebraic cryptanalys by auxiliary channels, I need reference on this theme (book, thesis, ...), and ...
Frih Osmane's user avatar
1 vote
0 answers
711 views

how to measure/calculate guessing entropy for side channel attacks

I was going through the paper (https://link.springer.com/chapter/10.1007/978-3-319-66787-4_3), and I came across where authors says that accuracy alone is not enough as an evaluation metric and ...
user70858's user avatar
1 vote
0 answers
155 views

Side channel attack: Why building an eviction set is possible?

I'm learning about the side channel attack on the cache. I came to know that most of the attack (EVICT + TIME, PRIME + PROBE, PRIME + ABORT) on the cache is initiated by building an eviction set(a ...
randomUser's user avatar
1 vote
0 answers
174 views

AES Fault Attack

Induce random fault (non-zero) error in one byte before MixColumns in Round 9 I get last round key with 32 bit (4 bytes) missing (Missing are bytes 1, 8, 11, 14) How can I recover these key bytes ...
nWinter's user avatar
  • 11
1 vote
0 answers
47 views

Randomness in Trichina's secure AND operation

In this paper, Elena Trichina introduces a way to compute a masked AND operation. The principle is the following: Having two operands $a$ and $b$ masked with random boolean shares $x$ and $y$ ($\...
Raoul722's user avatar
  • 2,836
0 votes
1 answer
82 views

Difference between Decryption-failure and Plaintext-checking oracles

I am reading this paper, which in the introduction, tells about two main types of key recovery SCAs : Reaction_type SCAs, which uses a decryption failure oracle Message-recovery-type SCAs, which uses ...
rerouille's user avatar
0 votes
0 answers
162 views

How to get dp and dq of CRT-RSA?

I am learning to utilize flush+reload method to get private key of CRT-RSA. CRT-RSA calculates two parts separately: mp = c^dp mod p and ...
Gerrie's user avatar
  • 101
0 votes
0 answers
66 views

RSA private key revealing by decrypting c=n-1

In RSA, if we use Square and always Multiply algorithm in decryption, how does decrypting the ciphertext $c=n-1$, while our public key is $(n,e)$, cause the private key $d$ to reveal due to side-...
Mohammadsadeq Borjiyan's user avatar
0 votes
0 answers
77 views

Masked RSA/BigInt Arithmetic?

Masking is the process of replacing operations (internally to some cryptographic algorithm) on intermediate values with operations on secret shared values. Then, even if some number of these secret-...
Mark's user avatar
  • 12.4k
0 votes
0 answers
103 views

Why does Montgomery Ladder not work for Brainpool curves

According to SafeCurves, the Brainpool curves mentioned there (P256t1 and P384t1) do not support the Montgomery Ladder for scalar multiplication in constant time. I am wondering why this is the case ...
mat's user avatar
  • 2,508
0 votes
0 answers
261 views

How to prevent cache timing attack on table lookup AES implementation?

I've been trying to find a solid method to prevent cache timing or other possible side channel attacks on an AES implementation, that uses lookup tables for S-box substitution. I realize that there ...
Aravind A's user avatar
  • 1,010
0 votes
0 answers
266 views

How does a cache timing attack work on AES with lookup tables?

I was trying to make a software only implementation of AES (Rijndael). At first I was able to implement it using table lookups for the Galois field multiplication and also for the SBox, but, I really ...
Aravind A's user avatar
  • 1,010
0 votes
0 answers
378 views

Computing guessing entropy (average rank of the correct key) in attack using deep learning

I am looking for help with some issues that I have about the guessing entropy (GE) in side-channel attacks context. I have read some papers where GE is used as a metric to measure the attack's ...
Servio's user avatar
  • 11
0 votes
0 answers
66 views

(Side channel) attack on a PIC18 micro controller

I'm trying to get some practical experience on (side channel) attacks. First I want to note all possible vulnerabilities. I thought about: Preset I have physical access and I own/wrote the software, ...
Shalec's user avatar
  • 407
0 votes
0 answers
471 views

Side channel attack on FPGA AES engine

I actually don't know if this is the right place where ask, but I try. The side channel attacks aren't a negligible problem. There are several ways to protect from these attacks its own IP inside the ...
haster8558's user avatar
0 votes
0 answers
320 views

side channel attacks against TDES (compared to AES)

We all know AES has some pretty strong side channel attacks, some where (with a couple of hundred know plain- and ciphertext combinations) a key can be derived in a matter of minutes. Others may take ...
Vincent's user avatar
  • 966