Questions tagged [side-channel-attack]

attacks using information leaked by implementations of cryptographic algorithms to obtain information about keys or (plaintext) data, instead of (or additional to) using cryptographic weaknesses.

Filter by
Sorted by
Tagged with
0
votes
0answers
5 views

How to split sbox input 4bit into 12 bit and how to find algebraic normal form(ANF) equation of SBox

I am new to Cryptography field and try to implement Threshold Implementation. In Decomposition of SBox into composition of two quadratic SBox. I am not getting how to split SBox input of 4bit into ...
3
votes
1answer
124 views

Have crypto side-channel attacks happened in the wild?

I'm aware of attacks extracting information via timing and volume. But none that care or attack the actual cryptographic algorithm implementation or end up extracting the key. Seeking examples if any ...
-1
votes
2answers
130 views

Will OTP provide quantum resistance under 5 conditions?

We already have quantum computing, but when quantum computing becomes commercially available there is a problem for many but not all encryption algorithm. The One-Time-Pad or OTP is the one and only ...
0
votes
0answers
17 views

How to find the output shares of first-order threshold implementation of cubic degree function?

Assume $d=abc$ and to implement first order threshold implementation , the minimum input and output shares are 4 (1*3+1) , and 4 , calculated using ${4\choose 3}$ , Theorem 2. The new TI ...
0
votes
1answer
47 views

Shuffling: Purpose and formal definition

To my understanding, shuffling means simply to permute the elements in vector $\mathbf{v}$ pseudorandomly, using a PRP $\pi (\mathrm{seed},\mathbf{v})$. A secure PRP should yield a permutation ...
5
votes
1answer
79 views

What quality of randomness is needed for randomized side channel countermeasures?

Using per-operation randomness is a popular and effective way to protect cryptographic implementations against side-channel attacks, e.g. using Shuffling (randomizing the processing order eg for AES ...
3
votes
2answers
375 views

Constant time multiplication in GF(2^8)

I am trying to implement AES in C; I would like to make it resistant to side-channel attacks but I can't implement the multiplication in constant time. My current code: ...
7
votes
0answers
150 views

How to implement arbitrary s-box in a side-channel-free way in C?

This could be a question for CodeReview.SE, but I thought it might require non-trivial cryptographic knowledge to merit it on-topic here. The C language is chosen as it's a common language for ...
1
vote
0answers
39 views

How vulnerable are SIMD operations to side channel attacks?

For a while, I was experimenting with optimization of several crypto implementations with SIMD (Single Instruction Multiple Data ) made available by C compiler ...
13
votes
1answer
2k views

Safely sorting secret data

Suppose you have a secret list of n distinct integers. How would you sort this list in a way that is not vulnerable to timing attacks? I tried looking up "...
2
votes
1answer
106 views

Is AES without T-Tables nor S-Box resistant to side-channel?

T-Tables and S-Boxes are prone to side-channel attacks, is an implementation without any lookup tables resistant to side-channel ? In this answer, https://crypto.stackexchange.com/a/63520/80926, the ...
1
vote
1answer
74 views

Is AES S-Box resistant to side-channel attacks?

I know that implemntations with T-tables such as Golang's are prone to side-channel attacks, but is AES's S-Box wihtout any additional table also insecure ?
3
votes
1answer
135 views

Timing attacks on homomorphic encryption

I've been wondering for a long time about programs that could potentially break fully homomorphic encryption schemes: ...
0
votes
1answer
54 views

Application of Non-deterministic Processors in side channel attacks

I was reading the abstract of "Non-deterministic Processors" paper by "David MayHenk L. MullerNigel P. Smart", in the abstract, they have mentioned the Kocher paper about "Timing Attacks on ...
0
votes
0answers
29 views

How to prevent cache timing attack on table lookup AES implementation?

I've been trying to find a solid method to prevent cache timing or other possible side channel attacks on an AES implementation, that uses lookup tables for S-box substitution. I realize that there ...
0
votes
0answers
22 views

How does breaking AES with a side channel attack (CPA) differ from a side channel attack on something like a microcontroller?

I'm studying CPA side channel attacks. CPA stands for Correlation Power analysis and it can be used to break AES. I'm familiar with the process to crack AES on a microcontroller. I was just wondering ...
1
vote
1answer
112 views

Does clustering the AES Sbox look up table to 32 bit entry per index, help reduce vulnerability to cache timing attacks?

I've been searching for some, easy methods to help mitigate, a cache timing attack on software AES implementations. Currently, my implementation uses, a usual 256 byte S-box ...
2
votes
1answer
73 views

Is it possible to perform CPA(Correlation Power Analysis) when attacker has only specific round's waveform?

I read Quite a lot document about breaking AES using CPA. But most of them, assuming that attacker has the first or last round of the waveform(trace) and exploit SubBytes. My question is if the AES-...
8
votes
1answer
2k views

How to confirm my implementation is constant time

I'm implementing Schnorr signatures following a variant used in Bitcoin Cash (BCH) of this algorithm: GitHub - Schnorr Signatures for secp256k1. A notable difference is that the BCH schnorr algorithm ...
0
votes
0answers
39 views

How does a cache timing attack work on AES with lookup tables?

I was trying to make a software only implementation of AES (Rijndael). At first I was able to implement it using table lookups for the Galois field multiplication and also for the SBox, but, I really ...
1
vote
0answers
60 views

Help on Algebraic Side Channel Attacks

I am a master student in computer security, I am preparing a dissertation thesis in the theme is: Algebraic cryptanalys by auxiliary channels, I need reference on this theme (book, thesis, ...), and ...
4
votes
1answer
137 views

Is Ed25519 really constant-time as widely implemented?

Despite the frequent claims that Ed25519 is more secure against side-channel attacks than (for instance) signatures performed over NIST P-256, I noticed that most implementations (including the ...
4
votes
1answer
101 views

Are there any masking methods for integer multiplication masking?

I'm interested in lattice type cryptosystem such as Mod-LWR. But I found that integer multiplication¹ is not safe for side-channel attacks. I tried to make masking method by own method but it failed ...
2
votes
0answers
99 views

Neural networks in Differential Power Analysis?

I am trying to understand how neural networks are used to do DPA, but I am having trouble understand DPA. My current understanding is that with DPA, we are just guessing one piece of a key at a time, ...
0
votes
0answers
81 views

Computing guessing entropy (average rank of the correct key) in attack using deep learning

I am looking for help with some issues that I have about the guessing entropy (GE) in side-channel attacks context. I have read some papers where GE is used as a metric to measure the attack's ...
2
votes
0answers
48 views

Security of bit shift in Serpent

As far I know, the Serpent cipher is the only cipher that uses legit bit shifts (<<) along with circular left shift (...
8
votes
2answers
343 views

What is TPMFail attack and what are the countermeasures?

Trusted Platform Module (TPM) is designed as a hardware-based root of trust to protect cryptographic keys even against system based adversaries. Although Intel's firmware based fTPM has FIPS 140-2 ...
0
votes
1answer
76 views

Side-channel attack in the real wold [duplicate]

I have a big problem to figure how the security model in papers about side-channel are relevant (briefly the attacker has a partial access to the hardware). Why these breaches are so seriously ...
2
votes
0answers
68 views

Side-channel vulnerability of AEGIS naive AES implementation

AEGIS, one of the finalists of CAESAR competition, uses a naive implementation of AES encryption round as its reference implementation. By naive I mean it uses secret dependent table lookups, so it is ...
1
vote
1answer
58 views

Is there a way to make a black-box function side-channel attack resistant?

If I have no knowledge of the inner workings of a function, (i.e. a black box function) is there a way to make it side-channel attack resistant? (For reference, I'm working with a JavaScript ...
26
votes
2answers
5k views

How are side-channel attacks executed? What does an attacker need to execute a side channel attack?

I've been reading about side-channel attacks on Wikipedia, and it seems that some of these can only be executed on the victim's computer. (I am specifically asking about the side-channel attacks ...
0
votes
1answer
66 views

Is encryption with the Web Cryptography API resistant against side channel attacks?

If I want to encrypt some payload with AES-GCM, with the Web Cryptography API, how resistant would this be against side channel attacks?
1
vote
1answer
37 views

Side-channel resistant discrete uniform sampling on $d\neq 2^t$ values?

Assume you have some source of $\mathsf{Bern}(1/2)$'s (probably some CSPRNG in practice). What is generally done to sample from $\mathsf{Unif}([d])$ in a side-channel resistant way (assuming $d$ isn't ...
1
vote
0answers
222 views

how to measure/calculate guessing entropy for side channel attacks

I was going through the paper (https://link.springer.com/chapter/10.1007/978-3-319-66787-4_3), and I came across where authors says that accuracy alone is not enough as an evaluation metric and ...
6
votes
1answer
140 views

Why do Edwards curves protect against side-channel attacks?

From Wikipedia: One of the attractive feature of the Edwards Addition law is that it is strongly unified i.e. it can also be used to double a point, simplifying protection against side-channel ...
1
vote
0answers
62 views

Side channel attack: Why building an eviction set is possible?

I'm learning about the side channel attack on the cache. I came to know that most of the attack (EVICT + TIME, PRIME + PROBE, PRIME + ABORT) on the cache is initiated by building an eviction set(a ...
0
votes
1answer
34 views

Questions about indexing a hash output to compose a final key

Recently I have watched the video Multi-Precision Arithmetic for Cryptology in C++, at Run-Time and at Compile-Time (at 21:56 seg) : The speaker says that to use a byte from the user key as a ...
2
votes
0answers
59 views

Side Channel Attack Evaluation Methods

I am studying the SCA Evaluation method success rate, and I have a doubt regarding to it. From my understanding, to calculate success rate, first we have a pool of traces all using same key and ...
2
votes
1answer
87 views

Fault attacks inside a loop

I am working on an attack that involves changing a constant inside a loop. Consider the simplified example is as below, ...
4
votes
0answers
89 views

Why is it safe to generate the secret key and masking vectors using rejection sampling in CRYSTALS-Dilithium?

In CRYSTALS-Dilithium module lattice-based digital signatures, the secret key vectors $s_1, s_2$ with coefficients in $[-\eta, \eta]$ and the signature masking vector $y$ with coefficients in $(-\...
2
votes
0answers
44 views

RSA: Blinding versus fixed-time computation

For RSA, what is the standard solution against timing attacks? I know about RSA blinding as one solution. Another solution is to always compute both the squared value and square-and-multiply values, ...
0
votes
1answer
238 views

Caculating Correlation for CPA attack on AES

I am having some trouble understanding how to calculate the correlation coefficient for CPA attack on AES. In the article Study of Deep Learning Techniques for Side-Channel Analysis and Introduction ...
6
votes
1answer
196 views

Does a masked look-up table prevent cache timing attacks?

When applying the boolean masking countermeasure to a cipher which uses an S-box $S$, a way to handle this nonlinear operation is to recompute a new S-box $S'$ such that $S'(x \oplus r_{in}) = S(x) \...
0
votes
1answer
126 views

What is the purpose of multiple key addition layers in AES?

I understand the purpose of the SubBytes layer (confusion) and the ShiftRows and MixColumns layers (diffusion). But I don't see the purpose of having more than one key addition layer. What I've been ...
2
votes
0answers
105 views

AES-128 8th round bit fault propagation

It's well known that by injecting a byte fault during the 8th round of AES 128 just before the mix column the key can be recovered with $2^{32}$-key space. A brute force attack is then possible but ...
19
votes
1answer
949 views

If a single bit was known through all states in AES, which would cause the most information to leak?

This question is motivated by some bad Verilog. Due to someone being sloppy with port assignments and a output statement, I have an AES core that has a single-bit from a S-Box in the key schedule ...
2
votes
1answer
93 views

Attacks on one-time pad, given a property of keys

An adversary $A$, eavesdrops $n$ cipher-texts, $c_{1}, c_{2} ..., c{_n}$. It also knows a value $v$ and a function $f$ such that $$f(k_{1}, k_{2}, ..., k_{n}) = v$$ where, $k_{i}$ is used to encrypt $...
2
votes
2answers
65 views

Does side-channel attacks offer any difficulty to Stinson's concept of `provable security'?

Here's a quote from Douglas Stinson: “[i]f a cryptosystem can be ‘broken’ in some specific way, then it would be possible to efficiently solve some well-studied problem that is thought to be ...
2
votes
1answer
95 views

Statistical (innefective) Fault Attacks on DES

I read this paper: Exploiting Ineffective Fault Inductions on Symmetric Cryptography. I was wondering if the same idea is applicable for DES. I know both algorithms are symmetric but the idea is not ...
2
votes
1answer
121 views

Timing Side Channel on error-correcting code

This question may be a basic question but it is not clear to me at the moment. I have an Error Correcting Code (ECC) in a key-encapsulation scheme designed for post-quantum cryptography which ...