Questions tagged [side-channel-attack]

attacks using information leaked by implementations of cryptographic algorithms to obtain information about keys or (plaintext) data, instead of (or additional to) using cryptographic weaknesses.

Filter by
Sorted by
Tagged with
1 vote
0 answers
131 views

Need help with Cryptohack's ProSign 3 ECDSA problem [closed]

I'm trying to solve the CTF challenge called ProSign 3 at Cryptohack platform which involves exploiting an ECDSA signing service that allows us to sign a fixed message being padded with the time ... ...
1 vote
1 answer
127 views

Stream slicing operation in block cipher and side-channel attack

My symmetric block cipher works kind of like a stream cipher, but it works on $128$-bit blocks. It generates a $128$-bit block in every round. And at the end of the round, I have to slice it into two ...
3 votes
1 answer
694 views

Cracking a key using a combination of partial keys

As part of a cryptanalytic attack I've carried out, I used a divide-and-conquer strategy to divide the secret key $k$ into several equal-sized partial keys $k = {k_1, k_2, ...}$. The attack works ...
0 votes
1 answer
89 views

Difference between Decryption-failure and Plaintext-checking oracles

I am reading this paper, which in the introduction, tells about two main types of key recovery SCAs : Reaction_type SCAs, which uses a decryption failure oracle Message-recovery-type SCAs, which uses ...
3 votes
1 answer
242 views

Implications of switching RSA padding schemes

In my company we want to switch from PKCSv1.5 to PSS for RSA signing. This is because of the marvin attack vector. My question is, if an adversary can see many similar messages that were signed with ...
3 votes
1 answer
115 views

What could be the side-channel attacks countermeasures other than secure memory overwriting?

I'm seeking guidance on mitigating side-channel attacks in a cryptographic application where securely overwriting memory with zeros after use may not always be feasible. While I understand the ...
0 votes
2 answers
115 views

Has garbage-collection been used for side-channel attacks?

I'm thinking of cryptographic implementations on garbage-collected (gc) languages/runtimes and that the gc process can be potentially dangerous for an implementation even if the implementation has the ...
3 votes
0 answers
116 views

How do you securely implement a finite field?

I'm not sure if this question belongs here or to StackOverflow. Please flag it if not. I'm trying to implement a standalone library for finite field arithmetic of prime and prime power order as a way ...
1 vote
3 answers
130 views

Is an if-else calling same function(s) vulnerable to side channel attacks

If I have a function f(x, y) and g(x, y) and f and g a are constant time, is the following code vulnerable to side channel ...
2 votes
1 answer
276 views

Choosing (key,plain) to produce zero state in middle rounds of AES encrypt

I was told in passing that (key, plain) pairs could be chosen to produce a zero state in AES encrypt in some middle round (say 5). [The application here being to side-channel leakage assessment.] ...
1 vote
0 answers
53 views

Where do we put known bits of nonce when performing lattice attack on ECDSA?

I have read so many papers and posts about lattice attacks on ECDSA but none of them used an example of different MSB values for k but instead they all used fixed MSB. So here i am trying to ...
4 votes
2 answers
425 views

Montgomery Powering Ladder and Side Channel Attacks: Is it practically (im-)possible to analyze where intermediate values are stored?

The Montgomery Powering Ladder performs an exponentiation with the operations square and multiply (called double and add in the case of elliptic curves). To my knowledge the order and kind of ...
0 votes
1 answer
83 views

Can attackers see the values I pass on to OpenSSL API functions?

Respected community, I am using the OpenSSL API's, especially libcrypto and libssl and I am really depressed, thinking about ...
4 votes
0 answers
110 views

Masking countermeasures for AES-GCM

Suppose I have a masked AES encryption $AES(\oplus_i K_i, \oplus_i P_i)=\oplus_i C_i$, i.e. the key, plaintext, and resulting ciphertext are tuples $K_i$, $P_i$, and $C_i$ that sum to $K$, $P$, and $C$...
1 vote
1 answer
105 views

In hardware, why using an algebraic implementation of a (small) S-Box instead of a LUT?

There is this cool paper https://eprint.iacr.org/2017/395.pdf exposing a side channel protected implementation of keccak, in particular Domain Oriented Masking for the Chi function. The Chi function ...
2 votes
1 answer
115 views

Constant-Time Base64 Codec - Necessity and Implementation

As we know, the popular PEM format for textualizing private key binary blobs uses base64 encoding. Typical base64 codecs use look-up tables to find characters and byte values and pack them together, ...
1 vote
1 answer
65 views

Does compressed data expose information about non-compressed data when encrypted together?

I know that compressing data before encrypting it can cause a compression oracle attack such as in the CRIME and BREACH attacks, but if only part of the data is compressed, e.g. non-user controlled ...
8 votes
2 answers
371 views

Is the elliptic-curve cryptography library libsecp256k1 not susceptible to the Hertzbleed attack?

I was reading up on the recently disclosed Hertzbleed side channel attack(s). It was speculated on Twitter that the elliptic-curve cryptography library libsecp256k1 is not susceptible to these attacks....
5 votes
2 answers
117 views

How to prevent power analysis on software level?

When attacking RSA with Square&Multiply, one can figure out the secret key by looking at the exponentiation algorithm itself. To prevent this in software, we could use dummy multiplications after ...
2 votes
1 answer
81 views

why sbox input XOR sbox output can be sensitive data of side channel attack?

As several intermediate values are used as sentive data for side channel analysis (DPA), I don't understand why sbox input ^ sbox output is also wide-used and effective. This value does not applied in ...
1 vote
1 answer
85 views

Constant-time decompression on an elliptic curve

Let $E\!: y^2 = f(x)$ be an elliptic curve over a finite field $\mathbb{F}_{q}$ of odd characteristic. Consider an $\mathbb{F}_{q}$-point $P = (x,y)$ on $E$. Suppose that we only have the $x$-...
1 vote
0 answers
85 views

Issue with understanding Side Channel Attacks

I am currently working on Side Channel Attacks (SCA) on Kyber and Dilithium. I have found myself quite confused with side channel, because so much is mentionned all the time. For instance, I don't ...
3 votes
1 answer
2k views

What is the difference between perfoming Correlation Power Analysis (CPA) in the first AES round and doing it in the last round?

I have a script that helps me to make to make a Correlation Power Analysis (CPA) attack. I am trying to attack the first round. As input, I put: my traces my plaintexts my key The steps to make the ...
1 vote
1 answer
91 views

Are you aware of cryptographic contexts (e.g., post-quantum) in which a square root $\sqrt{\cdot}$ must be computed in constant time?

Let $\mathbb{F}_q$ be a finite field of odd characteristic. I know that a constant-time implementation of the square root extraction $\sqrt{\cdot} \in \mathbb{F}_q$ is used in the context of hashing ...
2 votes
1 answer
112 views

Pros and cons about padding a cryptogram produced with an "additive" operation mode

These days I found myself thinking about the implications of padding or not padding block cipher modes that act like additive stream ciphers (I meant OFB, CTR, GCM etc). Let's call additive modes. You ...
0 votes
1 answer
38 views

Fan et al. Recovering MSD's

I have been trying to understand the method of recovering the MSD of the nonce proposed by Fan et al. (section 4.2), in their attack targeting wNAF implementation for scalar multiplication in the ...
46 votes
1 answer
25k views

Why use argon2i or argon2d if argon2id exists?

I am currently working on a project where I want to implement Argon2. The problem is that I dont really know a lot about it. Internet research is not really helpful, because Argon2 is only 2 years old ...
4 votes
1 answer
567 views

Dilithium signature scheme and timing attacks – Does the running time actually depend on the secret key?

The paper “CRYSTALS – Dilithium: Digital Signatures from Module Lattices” (by Léo Ducas, Tancrède Lepoint, Vadim Lyubashevsky, Peter Schwabe, Gregor Seiler, and Damien Stehlé) introduces a digital ...
5 votes
0 answers
266 views

Why is it safe to generate the secret key and masking vectors using rejection sampling in CRYSTALS-Dilithium?

In CRYSTALS-Dilithium module lattice-based digital signatures, the secret key vectors $s_1, s_2$ with coefficients in $[-\eta, \eta]$ and the signature masking vector $y$ with coefficients in $(-\...
1 vote
1 answer
81 views

How new cache designs stop cache-based side channel attacks

How do new cache designs aid in defending against cache-based side-channel attacks? While conducting a side-channel attack, we have the T-table/S-virtual box's address. Normally, address mapping is ...
9 votes
2 answers
415 views

How to implement arbitrary s-box in a side-channel-free way in C?

This could be a question for CodeReview.SE, but I thought it might require non-trivial cryptographic knowledge to merit it on-topic here. The C language is chosen as it's a common language for ...
2 votes
1 answer
277 views

Generic attack on Hmac sha256

Is there any generic attack on HMAC SHA 256 ? I am currently reading up on attacks on Hmac sha-256. However most of the papers I've found are about side channel attacks such as Differential power ...
0 votes
0 answers
169 views

How to get dp and dq of CRT-RSA?

I am learning to utilize flush+reload method to get private key of CRT-RSA. CRT-RSA calculates two parts separately: mp = c^dp mod p and ...
6 votes
3 answers
3k views

What do you call a random number that affects the calculation, but not the result?

This is about the same random ladder algorithm as my previous question. It computes f(g,n,r)=n*g or g^n (depending on the group notation), where g is a generator of a group. Suppose n=5882353. This ...
2 votes
2 answers
225 views

How do I try a timing attack on a public-key implementation on a general-purpose computer?

I'm writing a higher-order function in Haskell for use in public-key algorithms; it works equally well for RSA or elliptic curves. I'd like to test it for susceptibility to side channel attacks. How ...
2 votes
2 answers
5k views

Fault attack on RSA-CRT

I am trying to understand fault attack on RSA-CRT, and I found some example, which I don't know how to solve it. I know public modulus $N$, public exponent $e$, a value of faulty signature (where ...
2 votes
2 answers
592 views

Sliding windows implementation (Exponentiation by squaring)

I am conducting a research on CPU-cache based info leak caused by using Sliding window in the Diffie-Hellman key exchange. For my research I am looking for a real-world implementation of sliding ...
6 votes
0 answers
230 views

Are side-channels a concern for AEAD key commitment fixes?

I'm currently debating whether to revert to a non-committing AEAD (ChaCha20-Poly1305) instead of a committing AEAD based on Encrypt-then-MAC (XChaCha20-BLAKE2b) for stream encryption. Borg backup made ...
4 votes
2 answers
1k views

Side-Channel Attacks in the Cloud

Let's say we have some very sensitive personal files. At all costs, we do not want any other pair of eyeballs to gaze upon them. We need these sensitive files to be secure and available. So, we have ...
0 votes
1 answer
92 views

Constant time empty string validation

Checks for null require an == check. If you have a string secret (say a hex-encoded key) and you want to check it's empty for validation should you compare it to <...
0 votes
2 answers
2k views

Practical Attack on RSA

Currently I am designing an RSA based application, and I am thinking of how long should the key be in order to be secure against attacks. I know that RSA 4096 bit key can be recovered using Sound ...
2 votes
1 answer
2k views

Defence against timing attacks

I know this is a difficult subject but would a good defense against timing attacks be not sending a message if the decryption or authentication fails? So if the attacker provides a wrong HMAC for ...
6 votes
2 answers
1k views

Cryptanalysis and weaknesses of SEED cipher

I've discovered that a client has SEED enabled in their SSL ciphers, and would like to know a bit more about it from a security perspective. The Wikipedia article doesn't mention any flaws, yet I've ...
2 votes
1 answer
87 views

Can cryptographic accelerators along with side channel attack be used for GPS spoofing?

While having a discussion with someone on a forum about GPS spoofing, he mentioned that GPS signal can be spoofed for a cruising missile and make it land somewhere else using side-channel attack along ...
3 votes
1 answer
401 views

Correlation Power Analysis on AES - possible attack models

As far as I know it is possible to extract the key or key parts using side channel power analysis attack on AES, but we need some strong attacker model in order to do that. The first attack I know ...
3 votes
1 answer
1k views

Compression-Ratio Side Channel

I'm working through the matasano crypto challenges, and I'm onto set 7, where they describe an attack on encryption/compression oracles. I am having trouble understanding the attacks, more so the ...
0 votes
0 answers
66 views

RSA private key revealing by decrypting c=n-1

In RSA, if we use Square and always Multiply algorithm in decryption, how does decrypting the ciphertext $c=n-1$, while our public key is $(n,e)$, cause the private key $d$ to reveal due to side-...
0 votes
1 answer
391 views

Is CBC mode of encryption still safe as long as it's not use to send messages over a network?

I'm still reading about the Padding Oracle attack and Side Channel attack that can be performed to decrypt cipher text encrypted with CBC though it's still not clear to me. But base on my little ...
0 votes
0 answers
82 views

Masked RSA/BigInt Arithmetic?

Masking is the process of replacing operations (internally to some cryptographic algorithm) on intermediate values with operations on secret shared values. Then, even if some number of these secret-...
9 votes
2 answers
1k views

Constant time multiplication in GF(2^8)

I am trying to implement AES in C; I would like to make it resistant to side-channel attacks but I can't implement the multiplication in constant time. My current code: ...

1
2 3 4 5