# Questions tagged [side-channel-attack]

attacks using information leaked by implementations of cryptographic algorithms to obtain information about keys or (plaintext) data, instead of (or additional to) using cryptographic weaknesses.

163 questions
Filter by
Sorted by
Tagged with
186 views

### Lattice-based cryptography prone to side channel attack?

Is lattice-based cryptography still prone to side channel attacks? What are some mitigation strategies, if any?
13k views

### Why use argon2i or argon2d if argon2id exists?

So I am currently working on a GitHub project of mine and I want to implement Argon2. The problem is that I dont really know a lot about it. Internet research is not really helpful, because Argon2 is ...
141 views

### Why do Edwards curves protect against side-channel attacks?

From Wikipedia: One of the attractive feature of the Edwards Addition law is that it is strongly unified i.e. it can also be used to double a point, simplifying protection against side-channel ...
38 views

### Side-channel resistant discrete uniform sampling on $d\neq 2^t$ values?

Assume you have some source of $\mathsf{Bern}(1/2)$'s (probably some CSPRNG in practice). What is generally done to sample from $\mathsf{Unif}([d])$ in a side-channel resistant way (assuming $d$ isn't ...
74 views

### Side channel attack: Why building an eviction set is possible?

I'm learning about the side channel attack on the cache. I came to know that most of the attack (EVICT + TIME, PRIME + PROBE, PRIME + ABORT) on the cache is initiated by building an eviction set(a ...
34 views

### Questions about indexing a hash output to compose a final key

Recently I have watched the video Multi-Precision Arithmetic for Cryptology in C++, at Run-Time and at Compile-Time (at 21:56 seg) : The speaker says that to use a byte from the user key as a ...
60 views

### Side Channel Attack Evaluation Methods

I am studying the SCA Evaluation method success rate, and I have a doubt regarding to it. From my understanding, to calculate success rate, first we have a pool of traces all using same key and ...
200 views

### Can the lengths of HTTPS requests be used to deduce which public pages on a site are visited?

I thought of this recently: There are some websites which have many publicly accessible pages, some of which could be embarrassing despite being public (e.g. Wikipedia). The HTML for these pages also ...
87 views

### Fault attacks inside a loop

I am working on an attack that involves changing a constant inside a loop. Consider the simplified example is as below, ...
104 views

1k views

66 views

### Does side-channel attacks offer any difficulty to Stinson's concept of `provable security'?

Here's a quote from Douglas Stinson: ā[i]f a cryptosystem can be ābrokenā in some specific way, then it would be possible to efficiently solve some well-studied problem that is thought to be ...
121 views

### Timing Side Channel on error-correcting code

This question may be a basic question but it is not clear to me at the moment. I have an Error Correcting Code (ECC) in a key-encapsulation scheme designed for post-quantum cryptography which ...
63 views

### Side Channel Analysis (CorrPA), comparison between HW-results and measured power traces

I think I have missed something very fundamental. I am trying to understand the step in DPA where you compare your hypothetical power consumptions with your measured ones. The Matrix H with Matrix T. ...
588 views

### RSA most significant bit oracle attack

I have been reading up on RSA attacks and came across a problem that could be called a most-significant-bit (MSB) oracle attack. For the sake of clarity, let's define RSA primes $(p, q)$, private key ...
1k views

### Why don't table lookups run in constant time?

The Wikipedia article on big O notation says that performing a lookup is a constant time operation. So why are lookup tables susceptible to timing attacks?
138 views

### Why are matrices so common in symmetric encryption?

Matrices have been used in symmetric ciphers since the Hill Cipher (before?) all the way up to modern ciphers such as Twofish and AES. I understand matrices can be invertible, therefore making them ...
220 views

### How to Prevent Correlation Power Analysis Attack on AES?

Which techniques could be applied to AES to prevent these kind of attacks? I can just think of creating noise with a parallel process for random computation, so the signals have the combination of ...
202 views

### Regarding Lattice atttacks on ECDSA with a portion of known bits of the nonce k

I am new in the field of cryptography, and I am having some troubles understanding a concept regarding the lattice dimension needed in the attack on ECDSA using several messages with L known bits of ...
58 views

### How do we perform second order differential power analysis attack?

I have read papers which describe that the power traces(acquired from a side channel resistant implementation like masking) need to be centered and squared, then a correlation needs to be performed ...
351 views

### Sliding windows implementation (Exponentiation by squaring)

I am conducting a research on cpu-cache based info leak caused by using Sliding window in the diffie helman key exchange. For my research I am looking for a real-world implementation of sliding ...
345 views

### S-box and Side Channel Attacks

S-boxes with non-linearity greater than 112 are considered prone to side channel attacks. If a non-linear S- box with non- linearity greater than 112 (excluding bent functions with non-linearity of ...
145 views

### Montgomery Powering Ladder and Side Channel Attacks: Is it practically (im-)possible to analyze where intermediate values are stored?

The Montgomery Powering Ladder performs an exponentiation with the operations square and multiply (called double and add in the case of elliptic curves). To my knowledge the order and kind of ...
316 views

### Mitigating Side Channel Attack (SCA)

The SCA power attack described in 2016 article called "Power Side Channels in Security ICs: Hardware Countermeasures", depends on the measurement of power consumption fluctuations during AES-128 ...
315 views

### Why does side-channel security focus on āshieldingā rather than ājammingā?

I have always found it weird when in a crypto discussion people stressed the importance of making algorithms runtime-deterministic, to the point of avoiding any compiler optimisations. To me, it ...
153 views

### Side-Channel attack on RSA decryption using comparison result with p,q?

I was pointed to whether we could learn the secret key of RSA by repeatedly using following side channel: We assume that there exists a side channel in RSA decryption using CRT that, if the most-...
635 views

### side channel attacks on AES

Say you have a web application that's performing AES encryption. What sorts of side channel attacks should one keep an eye out for? Timing attacks affect RSA more than symmetric ciphers in-so-far as ...
46 views

### (Side channel) attack on a PIC18 micro controller

I'm trying to get some practical experience on (side channel) attacks. First I want to note all possible vulnerabilities. I thought about: Preset I have physical access and I own/wrote the software, ...
845 views

### Constant time implementations of crypto algorithms

To protect against cache attacks (side channel attacks) generally constant time crypto implementations are advised. In some cases DJB released new algorithms (chacha) that are designed with this in ...
669 views

### Does blinding work against side channel on RSA?

In the so called "blinding" technique for RSA, prior to decryption, the ciphertext is multiplied by random $r$ raised to the power of $e$; e.g., $C$ is replaced with $C\cdot r^e$; and then after ...
524 views

### Protocol for Sharing Blinding Factor with RSA

What is the protocol for choosing blinding factor when RSA is applied with key blinding? (Related question: How would you find the Blinding factor R in RSA blind signature algorithm?) Since blinding ...
437 views

### Do people not care about side channel resistance?

Recently, I have been browsing a lot through libraries that implementing Shamir secret sharing. I see a lot of code that implements this cryptographic algorithm without any side channel (timing/branch/...
102 views

### Is the context of “constant time” algorithms inclusive when you have a clock control?

There is generally a push to make algorithms and components constant time to be resistance to side channel attacks. For instance, AES-NI instructions take as many cycles as rounds; however, I can ...