Questions tagged [side-channel-attack]

attacks using information leaked by implementations of cryptographic algorithms to obtain information about keys or (plaintext) data, instead of (or additional to) using cryptographic weaknesses.

Filter by
Sorted by
Tagged with
1
vote
0answers
38 views

Hashing of variable-length chunked data leading to leakage of secret key from side channel?

Hypothetically, secret data could be hashed in some schemes in one way or another. Could chunking of the data lead to exposure of secret component through side channel? Say converting a randomized ...
2
votes
1answer
55 views

Why shouldn't cryptocurrency hash algorythms, resist side channel attack?

2015's Argon2 publication suggests that cryptocurrency hashing like password hashing on backend servers should not be subject to side-channel attack: Argon2d is optimized for settings where the ...
1
vote
2answers
79 views

Side channel attack - execution time depends on the size of the key

In my algorith execution time depends on the size of the key. It is a linear relationship (probably). The larger the key, the longer the algorithm takes to run. I have a code in Python so far. For ...
0
votes
1answer
42 views

Stream slicing operation in block cipher and side-channel attack

My symmetric block cipher works kind of like a stream cipher, but it works on $128$-bit blocks. It generates a $128$-bit block in every round. And at the end of the round, I have to slice it into two ...
-1
votes
0answers
20 views

Block slicing operation and side-channel attack

I got block slicing operation in my cipher. I mean after each round we take first $a$ bits and second $b$ bits of 128-bit block and then compute $b+a$. $a$ and $b=128-a$ is computed from key schedule ...
2
votes
0answers
47 views

Is “double-and-add-always” a good mitigation against side channel attacks?

In Discrete Log based Cryptography, one of the core operations that one, has to perform is modulo exponentiation. There are many algorithms to choose from, especially, when considering my point of ...
3
votes
1answer
131 views

Have crypto side-channel attacks happened in the wild?

I'm aware of attacks extracting information via timing and volume. But none that care or attack the actual cryptographic algorithm implementation or end up extracting the key. Seeking examples if any ...
-1
votes
2answers
134 views

Will OTP provide quantum resistance under 5 conditions?

We already have quantum computing, but when quantum computing becomes commercially available there is a problem for many but not all encryption algorithm. The One-Time-Pad or OTP is the one and only ...
0
votes
0answers
20 views

How to find the output shares of first-order threshold implementation of cubic degree function?

Assume $d=abc$ and to implement first order threshold implementation , the minimum input and output shares are 4 (1*3+1) , and 4 , calculated using ${4\choose 3}$ , Theorem 2. The new TI ...
0
votes
1answer
49 views

Shuffling: Purpose and formal definition

To my understanding, shuffling means simply to permute the elements in vector $\mathbf{v}$ pseudorandomly, using a PRP $\pi (\mathrm{seed},\mathbf{v})$. A secure PRP should yield a permutation ...
6
votes
1answer
80 views

What quality of randomness is needed for randomized side channel countermeasures?

Using per-operation randomness is a popular and effective way to protect cryptographic implementations against side-channel attacks, e.g. using Shuffling (randomizing the processing order eg for AES ...
3
votes
2answers
391 views

Constant time multiplication in GF(2^8)

I am trying to implement AES in C; I would like to make it resistant to side-channel attacks but I can't implement the multiplication in constant time. My current code: ...
7
votes
0answers
153 views

How to implement arbitrary s-box in a side-channel-free way in C?

This could be a question for CodeReview.SE, but I thought it might require non-trivial cryptographic knowledge to merit it on-topic here. The C language is chosen as it's a common language for ...
1
vote
0answers
41 views

How vulnerable are SIMD operations to side channel attacks?

For a while, I was experimenting with optimization of several crypto implementations with SIMD (Single Instruction Multiple Data ) made available by C compiler ...
13
votes
1answer
2k views

Safely sorting secret data

Suppose you have a secret list of n distinct integers. How would you sort this list in a way that is not vulnerable to timing attacks? I tried looking up "...
2
votes
1answer
113 views

Is AES without T-Tables nor S-Box resistant to side-channel?

T-Tables and S-Boxes are prone to side-channel attacks, is an implementation without any lookup tables resistant to side-channel ? In this answer, https://crypto.stackexchange.com/a/63520/80926, the ...
1
vote
1answer
79 views

Is AES S-Box resistant to side-channel attacks?

I know that implemntations with T-tables such as Golang's are prone to side-channel attacks, but is AES's S-Box wihtout any additional table also insecure ?
3
votes
1answer
136 views

Timing attacks on homomorphic encryption

I've been wondering for a long time about programs that could potentially break fully homomorphic encryption schemes: ...
0
votes
1answer
55 views

Application of Non-deterministic Processors in side channel attacks

I was reading the abstract of "Non-deterministic Processors" paper by "David MayHenk L. MullerNigel P. Smart", in the abstract, they have mentioned the Kocher paper about "Timing Attacks on ...
0
votes
0answers
31 views

How to prevent cache timing attack on table lookup AES implementation?

I've been trying to find a solid method to prevent cache timing or other possible side channel attacks on an AES implementation, that uses lookup tables for S-box substitution. I realize that there ...
0
votes
0answers
22 views

How does breaking AES with a side channel attack (CPA) differ from a side channel attack on something like a microcontroller?

I'm studying CPA side channel attacks. CPA stands for Correlation Power analysis and it can be used to break AES. I'm familiar with the process to crack AES on a microcontroller. I was just wondering ...
1
vote
1answer
114 views

Does clustering the AES Sbox look up table to 32 bit entry per index, help reduce vulnerability to cache timing attacks?

I've been searching for some, easy methods to help mitigate, a cache timing attack on software AES implementations. Currently, my implementation uses, a usual 256 byte S-box ...
2
votes
1answer
80 views

Is it possible to perform CPA(Correlation Power Analysis) when attacker has only specific round's waveform?

I read Quite a lot document about breaking AES using CPA. But most of them, assuming that attacker has the first or last round of the waveform(trace) and exploit SubBytes. My question is if the AES-...
8
votes
1answer
2k views

How to confirm my implementation is constant time

I'm implementing Schnorr signatures following a variant used in Bitcoin Cash (BCH) of this algorithm: GitHub - Schnorr Signatures for secp256k1. A notable difference is that the BCH schnorr algorithm ...
0
votes
0answers
39 views

How does a cache timing attack work on AES with lookup tables?

I was trying to make a software only implementation of AES (Rijndael). At first I was able to implement it using table lookups for the Galois field multiplication and also for the SBox, but, I really ...
1
vote
0answers
60 views

Help on Algebraic Side Channel Attacks

I am a master student in computer security, I am preparing a dissertation thesis in the theme is: Algebraic cryptanalys by auxiliary channels, I need reference on this theme (book, thesis, ...), and ...
4
votes
1answer
138 views

Is Ed25519 really constant-time as widely implemented?

Despite the frequent claims that Ed25519 is more secure against side-channel attacks than (for instance) signatures performed over NIST P-256, I noticed that most implementations (including the ...
5
votes
1answer
106 views

Are there any masking methods for integer multiplication masking?

I'm interested in lattice type cryptosystem such as Mod-LWR. But I found that integer multiplicationĀ¹ is not safe for side-channel attacks. I tried to make masking method by own method but it failed ...
2
votes
0answers
100 views

Neural networks in Differential Power Analysis?

I am trying to understand how neural networks are used to do DPA, but I am having trouble understand DPA. My current understanding is that with DPA, we are just guessing one piece of a key at a time, ...
0
votes
0answers
90 views

Computing guessing entropy (average rank of the correct key) in attack using deep learning

I am looking for help with some issues that I have about the guessing entropy (GE) in side-channel attacks context. I have read some papers where GE is used as a metric to measure the attack's ...
2
votes
0answers
48 views

Security of bit shift in Serpent

As far I know, the Serpent cipher is the only cipher that uses legit bit shifts (<<) along with circular left shift (...
8
votes
2answers
350 views

What is TPMFail attack and what are the countermeasures?

Trusted Platform Module (TPM) is designed as a hardware-based root of trust to protect cryptographic keys even against system based adversaries. Although Intel's firmware based fTPM has FIPS 140-2 ...
0
votes
1answer
77 views

Side-channel attack in the real wold [duplicate]

I have a big problem to figure how the security model in papers about side-channel are relevant (briefly the attacker has a partial access to the hardware). Why these breaches are so seriously ...
2
votes
0answers
69 views

Side-channel vulnerability of AEGIS naive AES implementation

AEGIS, one of the finalists of CAESAR competition, uses a naive implementation of AES encryption round as its reference implementation. By naive I mean it uses secret dependent table lookups, so it is ...
1
vote
1answer
59 views

Is there a way to make a black-box function side-channel attack resistant?

If I have no knowledge of the inner workings of a function, (i.e. a black box function) is there a way to make it side-channel attack resistant? (For reference, I'm working with a JavaScript ...
26
votes
2answers
5k views

How are side-channel attacks executed? What does an attacker need to execute a side channel attack?

I've been reading about side-channel attacks on Wikipedia, and it seems that some of these can only be executed on the victim's computer. (I am specifically asking about the side-channel attacks ...
0
votes
1answer
67 views

Is encryption with the Web Cryptography API resistant against side channel attacks?

If I want to encrypt some payload with AES-GCM, with the Web Cryptography API, how resistant would this be against side channel attacks?
1
vote
1answer
38 views

Side-channel resistant discrete uniform sampling on $d\neq 2^t$ values?

Assume you have some source of $\mathsf{Bern}(1/2)$'s (probably some CSPRNG in practice). What is generally done to sample from $\mathsf{Unif}([d])$ in a side-channel resistant way (assuming $d$ isn't ...
1
vote
0answers
237 views

how to measure/calculate guessing entropy for side channel attacks

I was going through the paper (https://link.springer.com/chapter/10.1007/978-3-319-66787-4_3), and I came across where authors says that accuracy alone is not enough as an evaluation metric and ...
6
votes
1answer
140 views

Why do Edwards curves protect against side-channel attacks?

From Wikipedia: One of the attractive feature of the Edwards Addition law is that it is strongly unified i.e. it can also be used to double a point, simplifying protection against side-channel ...
1
vote
0answers
68 views

Side channel attack: Why building an eviction set is possible?

I'm learning about the side channel attack on the cache. I came to know that most of the attack (EVICT + TIME, PRIME + PROBE, PRIME + ABORT) on the cache is initiated by building an eviction set(a ...
0
votes
1answer
34 views

Questions about indexing a hash output to compose a final key

Recently I have watched the video Multi-Precision Arithmetic for Cryptology in C++, at Run-Time and at Compile-Time (at 21:56 seg) : The speaker says that to use a byte from the user key as a ...
2
votes
0answers
60 views

Side Channel Attack Evaluation Methods

I am studying the SCA Evaluation method success rate, and I have a doubt regarding to it. From my understanding, to calculate success rate, first we have a pool of traces all using same key and ...
2
votes
1answer
87 views

Fault attacks inside a loop

I am working on an attack that involves changing a constant inside a loop. Consider the simplified example is as below, ...
4
votes
0answers
101 views

Why is it safe to generate the secret key and masking vectors using rejection sampling in CRYSTALS-Dilithium?

In CRYSTALS-Dilithium module lattice-based digital signatures, the secret key vectors $s_1, s_2$ with coefficients in $[-\eta, \eta]$ and the signature masking vector $y$ with coefficients in $(-\...
2
votes
0answers
44 views

RSA: Blinding versus fixed-time computation

For RSA, what is the standard solution against timing attacks? I know about RSA blinding as one solution. Another solution is to always compute both the squared value and square-and-multiply values, ...
0
votes
1answer
240 views

Caculating Correlation for CPA attack on AES

I am having some trouble understanding how to calculate the correlation coefficient for CPA attack on AES. In the article Study of Deep Learning Techniques for Side-Channel Analysis and Introduction ...
6
votes
1answer
200 views

Does a masked look-up table prevent cache timing attacks?

When applying the boolean masking countermeasure to a cipher which uses an S-box $S$, a way to handle this nonlinear operation is to recompute a new S-box $S'$ such that $S'(x \oplus r_{in}) = S(x) \...
0
votes
1answer
144 views

What is the purpose of multiple key addition layers in AES?

I understand the purpose of the SubBytes layer (confusion) and the ShiftRows and MixColumns layers (diffusion). But I don't see the purpose of having more than one key addition layer. What I've been ...
2
votes
0answers
107 views

AES-128 8th round bit fault propagation

It's well known that by injecting a byte fault during the 8th round of AES 128 just before the mix column the key can be recovered with $2^{32}$-key space. A brute force attack is then possible but ...