Questions tagged [side-channel-attack]

attacks using information leaked by implementations of cryptographic algorithms to obtain information about keys or (plaintext) data, instead of (or additional to) using cryptographic weaknesses.

Filter by
Sorted by
Tagged with
38
votes
1answer
13k views

Why use argon2i or argon2d if argon2id exists?

So I am currently working on a GitHub project of mine and I want to implement Argon2. The problem is that I dont really know a lot about it. Internet research is not really helpful, because Argon2 is ...
36
votes
2answers
24k views

Practical disadvantages of GCM mode encryption

It seems that GCM mode encryption has a clear advantage over CBC + HMAC in the sense that it only requires a single key. But it seems that there are some experts here that do not trust it enough to ...
31
votes
3answers
7k views

How practical are side-channel attacks and how much of a concern are they?

I see a lot of research in very sophisticated side-channel attacks on crypto systems. Most (but definitely not all) seem to follow a trend, namely, the crypto system does something very dumb like ...
27
votes
5answers
3k views

Timing-Safety in JVM-Languages

How is it possible to write timing-safe code in JVM-languages (Java, Scala, Clojure...)? Is it possible to make libraries like BouncyCastle safe against timing-attacks? I know that even in C it is ...
26
votes
2answers
5k views

How are side-channel attacks executed? What does an attacker need to execute a side channel attack?

I've been reading about side-channel attacks on Wikipedia, and it seems that some of these can only be executed on the victim's computer. (I am specifically asking about the side-channel attacks ...
21
votes
3answers
5k views

Known methods for constant time (table-free) AES implementation using 'standard' operations?

There are several known methods for implementing AES in constant time using SIMD operations, mostly based around fast byte shuffling (for instance Hamburg and Kasper/Schwabe). Are there any similar ...
19
votes
1answer
954 views

If a single bit was known through all states in AES, which would cause the most information to leak?

This question is motivated by some bad Verilog. Due to someone being sloppy with port assignments and a output statement, I have an AES core that has a single-bit from a S-Box in the key schedule ...
18
votes
2answers
1k views

Can deterministic ECDSA be protected against fault attacks?

In a paper by Barenghi and Pelosi, it was described that fault attacks could be used to derive the secret key when using deterministic ECDSA as described in RFC6979 by @Thomas_Pornin Deterministic (...
18
votes
2answers
10k views

RSA least significant bit oracle attack

I have been reading up on RSA attacks and came across one that could be called a least-significant-bit (LSB) oracle attack. For the sake of clarity lets define RSA primes $(p, q)$, private key $d$ ...
17
votes
4answers
3k views

Should I delete cryptographic data from memory?

When dealing with cryptographic data, is there a chance that attacker recovers portion of data I used in my program? Should I try to delete every bit of keys and encrypted data that I used, overwrite ...
13
votes
1answer
2k views

Why do crypto libs use table lookups when they're vulnerable to timing attacks?

AESEngine.java, from BouncyCastle, uses table lookups as does aes_x86core.c, in OpenSSL. But per Cache-timing attacks on AES table lookups like what OpenSSL and BouncyCastle are doing are vulnerable ...
13
votes
1answer
2k views

Safely sorting secret data

Suppose you have a secret list of n distinct integers. How would you sort this list in a way that is not vulnerable to timing attacks? I tried looking up "...
12
votes
1answer
3k views

Why not use `<`, `>` or `==` in constant time comparison?

I am comparing secret data stored in arrays a and b to see which holds a greater value. My current (pseudo)code looks like this:...
12
votes
1answer
1k views

Is it possible to test implementation for side-channel attacks?

When it comes to implementing cryptographic algorithms, there seems to be a big focus on the difficulty of doing so without introducing the potential for side channel attacks and the knowledge ...
11
votes
3answers
2k views

Does AES-NI offer better side-channel protection compared to AES in software?

Does AES-NI offer better side-channel protection compared to AES in software? Also, it would be great of you could provide according references in your answer.
10
votes
3answers
1k views

Stopping timing attacks on AES: Why is it important to prevent the OS from interrupting the AES computation?

I read the paper Cache-timing attacks on AES (by Daniel J. Bernstein), but I don't seem to understand everything. The author dedicates a long section on how to prevent the OS to interrupt an AES ...
10
votes
1answer
4k views

AES timing attacks

I'm just interested in cryptography, so please don't expect me to be an expert. ;) I recently read about AES cache timing attacks and found it very interesting. I read the article Cache-timing attacks ...
10
votes
2answers
161 views

Information-theoretic bound on leakage by timing measurement

I'm looking for an information-theoretic bound on leakage by timing measurement. I'm assuming that an attacker wants to leak out of a black box a secret key of $k$ bits that is secretly injected into ...
9
votes
1answer
288 views

Are more complex algorithms easier to break with timing attacks?

Is there a point where increasing the complexity of an encryption algorithm will make it easier to break using a timing attack? Or is there no connection here at all?
9
votes
2answers
2k views

Why are side channel attacks such as SPA/DPA/ CPA based on the AES SubBytes routine?

I have three questions about AES related to side channel attacks: Why are side channel attacks such as CPA related to the non-linearity of the SubBytes routine within AES? What is the difference ...
9
votes
2answers
484 views

Conditions for a successful Differential Power Analysis attack

From this paper, there are two conditions for a successful DPA attack: i) there exists an intermediate variable in the implementation that is correlated with the power consumption and ii) this ...
9
votes
1answer
3k views

What is “Blinding” used for in cryptography?

What does "blinding" mean in cryptography, and where do we usually use it? Can you describe a sample implementation?
9
votes
1answer
499 views

Deterministic RSA blinding

I have an implementation of the RSA private key operation in a context where I don't have access to an entropy source. I'd like to add blinding to it (both message and exponent), to make it resist ...
9
votes
1answer
664 views

Side channel security of HMAC in software

Assume we have a processor with a symmetric co-processor that supports AES. This processor does however not provide co-processor support for hash algorithms such as SHA-1 or SHA-256. I've got the ...
8
votes
1answer
2k views

How to confirm my implementation is constant time

I'm implementing Schnorr signatures following a variant used in Bitcoin Cash (BCH) of this algorithm: GitHub - Schnorr Signatures for secp256k1. A notable difference is that the BCH schnorr algorithm ...
8
votes
3answers
389 views

Are there any symptoms of a side channel attack on the target chip?

I would like to know if there are some symptoms that let me detect if my integrated circuit is actually subject to a side channel attack. For example, are the following potential indicators? ...
8
votes
2answers
357 views

What is TPMFail attack and what are the countermeasures?

Trusted Platform Module (TPM) is designed as a hardware-based root of trust to protect cryptographic keys even against system based adversaries. Although Intel's firmware based fTPM has FIPS 140-2 ...
8
votes
1answer
4k views

Is ChaCha20 safer than AES with respect to side-channel attacks?

I've already seen some topics on this matter, but I feel like my question hasn't really been answered. Given the following: AES must be implemented in hardware (i.e. using the AES-NI instruction set)...
8
votes
1answer
200 views

Can the lengths of HTTPS requests be used to deduce which public pages on a site are visited?

I thought of this recently: There are some websites which have many publicly accessible pages, some of which could be embarrassing despite being public (e.g. Wikipedia). The HTML for these pages also ...
8
votes
1answer
437 views

Do people not care about side channel resistance?

Recently, I have been browsing a lot through libraries that implementing Shamir secret sharing. I see a lot of code that implements this cryptographic algorithm without any side channel (timing/branch/...
8
votes
0answers
126 views

Software timing attack using Kocher method

What's the minimum number of random sample points needed in Kocher's timing attack, so that we can determine enough valid measurements of $A_{i,r}$ and $D_{i,r}$? I'm working from this paper: Volker ...
7
votes
2answers
3k views

How to avoid side channel attacks when handling large numbers?

For cryptography, the platforms have limited size as 32 or 64-bit operations. We definitely need big numbers to implement the encryption/decryption and digital signatures for cryptosystems like RSA, ...
7
votes
3answers
636 views

Why should we consider the output of the AES s-box as a “sensitive value” in relation to side channel attacks?

In general, we consider the output of s-box in AES as a “sensitive value” in order to perform a side channel attack. I would be very grateful if you could explain to me the reason of that ...
7
votes
1answer
669 views

Does blinding work against side channel on RSA?

In the so called "blinding" technique for RSA, prior to decryption, the ciphertext is multiplied by random $r$ raised to the power of $e$; e.g., $C$ is replaced with $C\cdot r^e$; and then after ...
7
votes
1answer
3k views

Montgomery Ladder vs Double-and-Add

I would like to know what (if any) are the advantages of using Montgomery Power ladder over the Double-and-Add-Always algorithm. I think that firstly, Monty would be slightly faster than DoubleAndAdd. ...
7
votes
2answers
920 views

RSA Timing Attack on “Extra” Montgomery Reduction

In "A practical implementation of the timing attack", the authors take advantage of a timing difference that stems from "extra reductions" that occur when multiplying numbers in the Montgomery form. ...
7
votes
1answer
416 views

AES sbox security issue - power analysis attack?

I was wondering about whether the usage of a precomputed sbox (kind of a lookup table) could be a serious security issue when using AES. I am new to power analysis attacks, so it is hard to ...
7
votes
2answers
617 views

How does the split mask countermeasure work on AES?

I am trying to understand the split mask countermeasure which is a masking method to avoid side channel attacks. Let's first describe the principle and then try to apply it to AES. I found this paper ...
7
votes
1answer
82 views

What quality of randomness is needed for randomized side channel countermeasures?

Using per-operation randomness is a popular and effective way to protect cryptographic implementations against side-channel attacks, e.g. using Shuffling (randomizing the processing order eg for AES ...
7
votes
0answers
159 views

How to implement arbitrary s-box in a side-channel-free way in C?

This could be a question for CodeReview.SE, but I thought it might require non-trivial cryptographic knowledge to merit it on-topic here. The C language is chosen as it's a common language for ...
6
votes
3answers
1k views

Why don't table lookups run in constant time?

The Wikipedia article on big O notation says that performing a lookup is a constant time operation. So why are lookup tables susceptible to timing attacks?
6
votes
3answers
1k views

Is there a cryptographic algorithm which is immune to side channel attacks?

Is there any cryptographic algorithm immune to side channel attacks based on scan chain? In VLSI point of view.
6
votes
2answers
2k views

Timing attack on modular exponentiation

It is known that computing $a^x \bmod N$ takes $O(|x| + \mathrm{pop}(x))$ multiplications modulo $N$, where $|x|$ is the number of bits of $x$ and $\mathrm{pop}(x)$ is the number of $1$ bits (Hamming ...
6
votes
2answers
1k views

Cryptanalysis and weaknesses of SEED cipher

I've discovered that a client has SEED enabled in their SSL ciphers, and would like to know a bit more about it from a security perspective. The Wikipedia article doesn't mention any flaws, yet I've ...
6
votes
1answer
141 views

Why do Edwards curves protect against side-channel attacks?

From Wikipedia: One of the attractive feature of the Edwards Addition law is that it is strongly unified i.e. it can also be used to double a point, simplifying protection against side-channel ...
6
votes
1answer
327 views

Understanding Genkin-Pipman-Tromer's ground potential, side channel attack on RSA

I'm pretty sure that by now folks might have come across this research from Genkin-Pipman-Tromer (GPT) on extracting the RSA key used by GnuPG (GPG) just by measuring the ground potential. I'm going ...
6
votes
1answer
443 views

Double-and-add/Montgomery VS blinding

I'm having a hard time understanding why people use constant-time techniques to counter time-attacks, when blinding seems as good and cheaper to implement. Why do people avoid blinding in ECC?
6
votes
1answer
102 views

Is the context of “constant time” algorithms inclusive when you have a clock control?

There is generally a push to make algorithms and components constant time to be resistance to side channel attacks. For instance, AES-NI instructions take as many cycles as rounds; however, I can ...
6
votes
1answer
201 views

Does a masked look-up table prevent cache timing attacks?

When applying the boolean masking countermeasure to a cipher which uses an S-box $S$, a way to handle this nonlinear operation is to recompute a new S-box $S'$ such that $S'(x \oplus r_{in}) = S(x) \...
6
votes
2answers
542 views

power consumption in a XOR

I'm trying to understand how a XOR affect traces of power consumption in a Differential Power Analysis on smartcards. What's the difference in energy radiated in a $1 \oplus 1$ and in a $0 \oplus 1$? ...