Questions tagged [side-channel-attack]

attacks using information leaked by implementations of cryptographic algorithms to obtain information about keys or (plaintext) data, instead of (or additional to) using cryptographic weaknesses.

Filter by
Sorted by
Tagged with
4
votes
1answer
368 views

Dilithium signature scheme and timing attacks – Does the running time actually depend on the secret key?

The paper “CRYSTALS – Dilithium: Digital Signatures from Module Lattices” (by Léo Ducas, Tancrède Lepoint, Vadim Lyubashevsky, Peter Schwabe, Gregor Seiler, and Damien Stehlé) introduces a digital ...
1
vote
1answer
83 views

Scenario for applying power analysis

I have started doing some reading about power analysis (SPA, DPA), and it is not clear to me in what Scenario one would have to fear such an attack. It appears to me that a typical situation is ...
27
votes
5answers
3k views

Timing-Safety in JVM-Languages

How is it possible to write timing-safe code in JVM-languages (Java, Scala, Clojure...)? Is it possible to make libraries like BouncyCastle safe against timing-attacks? I know that even in C it is ...
3
votes
1answer
1k views

What is the difference between perfoming Correlation Power Analysis (CPA) in the first AES round and doing it in the last round?

I have a script that helps me to make to make a Correlation Power Analysis (CPA) attack. I am trying to attack the first round. As input, I put: my traces my plaintexts my key The steps to make the ...
6
votes
3answers
1k views

Is there a cryptographic algorithm which is immune to side channel attacks?

Is there any cryptographic algorithm immune to side channel attacks based on scan chain? In VLSI point of view.
8
votes
1answer
4k views

Is ChaCha20 safer than AES with respect to side-channel attacks?

I've already seen some topics on this matter, but I feel like my question hasn't really been answered. Given the following: AES must be implemented in hardware (i.e. using the AES-NI instruction set)...
1
vote
1answer
535 views

Implementation of a side channel attack? [closed]

As homework I need to find the password of a crackme in ascii-coded binary. We were also given a specific part of the crackme (in the image below), which we will need to use a side channel attack ...
2
votes
1answer
159 views

Strength of block ciphers under attack [by government level attackers]

So lets say the government has set their top priority to cracking a Veracrypt or Lukes or whatever volume containing highly confidential information. It uses AES or AES(Twofish). How would they start ...
4
votes
2answers
328 views

How would a side channel attack be carried out in a real life situation?

How would a timing attack against AES be carried out in a real situation? You could not guess the key from the processor's power usage after the plaintext is encrypted, right? And what would you need ...
11
votes
3answers
2k views

Does AES-NI offer better side-channel protection compared to AES in software?

Does AES-NI offer better side-channel protection compared to AES in software? Also, it would be great of you could provide according references in your answer.
2
votes
0answers
166 views

AES-128: How to find cipherkey comparing wrong and right ciphertexts?

I have a .mat file which contains 10 plaintexts and 10 ciphertexts which are correctly encrypted with AES-128 algorithm. It also contains 10 more ciphertexts which are wrongly encrypted. The fault is ...
3
votes
1answer
136 views

Is having AES tables on a distinct physical page enough to avoid cache timing attacks?

Reading about typical cache timing attacks, they seem to be based on intentional eviction of cache lines and timing how long an operation takes. It seems as if those attacks rely upon these tables ...
9
votes
2answers
2k views

Why are side channel attacks such as SPA/DPA/ CPA based on the AES SubBytes routine?

I have three questions about AES related to side channel attacks: Why are side channel attacks such as CPA related to the non-linearity of the SubBytes routine within AES? What is the difference ...
4
votes
1answer
223 views

FHE Block ciphers' usage

There are currently FHE implementation for AES Simon Speck, and may be more. Except for speed testing, amortized or not, one meaningful usage is mitigating form side channel analysis. Intel, AMD, or ...
3
votes
1answer
2k views

Side Channel Attacks

How to make cipher resist against Side channel Attacks. Specially Timing Attack, Cachet Timing Attach, Simple/ Differential Power Analysis. Uptil now it seems all Standard Algorithms like AES, ...
2
votes
0answers
260 views

Side-channel attacks for ARM conditional instructions

I'm implementing some cryptographic functions on an ARM Cortex-M4 and would like to be safe against side-channel attacks, like power and timing attacks. For efficiency I'd like to use conditional ...
7
votes
3answers
636 views

Why should we consider the output of the AES s-box as a “sensitive value” in relation to side channel attacks?

In general, we consider the output of s-box in AES as a “sensitive value” in order to perform a side channel attack. I would be very grateful if you could explain to me the reason of that ...
2
votes
1answer
70 views

Higher-Order Side Channel Security and Mask Refreshing: linear function?

I currently read about this paper: https://eprint.iacr.org/2015/359.pdf and I wanted to implement Algorithm 4 / Algorithm 5 on my own. There is one thing I cannot understand: where does function g ...
12
votes
1answer
3k views

Why not use `<`, `>` or `==` in constant time comparison?

I am comparing secret data stored in arrays a and b to see which holds a greater value. My current (pseudo)code looks like this:...
2
votes
1answer
647 views

Compression-Ratio Side Channel

I'm working through the matasano crypto challenges, and I'm onto set 7, where they describe an attack on encryption/compression oracles. I am having trouble understanding the attacks, more so the ...
7
votes
1answer
416 views

AES sbox security issue - power analysis attack?

I was wondering about whether the usage of a precomputed sbox (kind of a lookup table) could be a serious security issue when using AES. I am new to power analysis attacks, so it is hard to ...
3
votes
2answers
81 views

Are there some well-known crypto APIs that leak information?

Are there any well-known crypto APIs or libraries that leak or used to leak information (it can be the key or anything else)?
12
votes
1answer
1k views

Is it possible to test implementation for side-channel attacks?

When it comes to implementing cryptographic algorithms, there seems to be a big focus on the difficulty of doing so without introducing the potential for side channel attacks and the knowledge ...
21
votes
3answers
5k views

Known methods for constant time (table-free) AES implementation using 'standard' operations?

There are several known methods for implementing AES in constant time using SIMD operations, mostly based around fast byte shuffling (for instance Hamburg and Kasper/Schwabe). Are there any similar ...
4
votes
1answer
698 views

How can bit slicing be constant time, when Mix Columns is in the cipher

I'm reading about bit-slicing techniques, and one thing about it caught my mind. The strength with bit sliced implementations are (apart from that they are fast) that they are running in constant ...
7
votes
2answers
617 views

How does the split mask countermeasure work on AES?

I am trying to understand the split mask countermeasure which is a masking method to avoid side channel attacks. Let's first describe the principle and then try to apply it to AES. I found this paper ...
8
votes
0answers
126 views

Software timing attack using Kocher method

What's the minimum number of random sample points needed in Kocher's timing attack, so that we can determine enough valid measurements of $A_{i,r}$ and $D_{i,r}$? I'm working from this paper: Volker ...
4
votes
1answer
391 views

Exposed raw RSA private key operation

Assume that there is a smartcard or other hardware token that exposes the raw RSA private key operation (modular exponentiation, with or without CRT parameters). Is there any possibility that raw RSA ...
10
votes
3answers
1k views

Stopping timing attacks on AES: Why is it important to prevent the OS from interrupting the AES computation?

I read the paper Cache-timing attacks on AES (by Daniel J. Bernstein), but I don't seem to understand everything. The author dedicates a long section on how to prevent the OS to interrupt an AES ...
4
votes
1answer
60 views

Is it okay to use a variable-time RSA implementation to verify TLS certificates?

RSA as implemented by OpenSSL et al. needs to protect against side channel attacks, at a big performance penalty. However, TLS certificate validation involves no secrets. Therefore, I should be able ...
3
votes
1answer
105 views

Is rubberhose cryptanalysis a sidechannel - formally?

I recently was engaged in a discussion in Sec.SE where somebody used the term "sidechannel" to actually mean "circumvent the encryption". By what he said it was clear, that he wanted to not bother ...
1
vote
2answers
227 views

Are there any disadvantages of using libsodiums helpers for en-/decoding/comparision instead of the native ones?

Libsodium has some helpers, which allow hexdecimal decoding, encoding and also constant-time string comparison. So if you use the php binding libsodium-php you ...
1
vote
1answer
173 views

How to test an encryption against different attacks [closed]

For the last while I have been reading up on cryptography and the different kinds of methods for encryption (public key, blocks, etc) and the attacks against them. This got me wondering how to ...
4
votes
1answer
417 views

ChaCha20 immune to timing attacks

What are the reasons because of which ChaCha20 is immune to timing attacks ? Also why is not AES immune to timing attacks?
1
vote
1answer
2k views

How can a lattice attack be applied to ECDSA signatures?

The aim is to check if it is possible to break the ECDSA cryptosystem under the following criteria. Suppose that each ECDSA signature is generated by using the GLV method for point multiplication (...
9
votes
1answer
664 views

Side channel security of HMAC in software

Assume we have a processor with a symmetric co-processor that supports AES. This processor does however not provide co-processor support for hash algorithms such as SHA-1 or SHA-256. I've got the ...
5
votes
1answer
113 views

Optimal same-base exponentiation?

I've (finally) implemented the answer to this question in our library, which stated how to transform montgomery curves (and points) to weierstrass curves (and points). Now, for scalar multiplication, ...
2
votes
1answer
1k views

How does constant-time comparison work?

libsodium has a method for comparing two byte sequences in constant time. Is the idea here to simply avoid early-out if a difference in the data is detected? When I first heard of such a thing I ...
13
votes
1answer
2k views

Why do crypto libs use table lookups when they're vulnerable to timing attacks?

AESEngine.java, from BouncyCastle, uses table lookups as does aes_x86core.c, in OpenSSL. But per Cache-timing attacks on AES table lookups like what OpenSSL and BouncyCastle are doing are vulnerable ...
3
votes
1answer
110 views

Can string lookups be vulnerable to timing attacks like array lookups are?

Per “Can non-assembly crypto libraries truly be secure against timing attacks?”, array lookups are vulnerable to timing attacks. Like, if you do cresult[map[i]] and ...
4
votes
2answers
255 views

Power analysis and exponentiation by squaring

I am trying to understand how one can retrieve the secret exponent via a simple power analysis. Lets suppose that the exponentiation by squaring algorithm is implemented in its simplest form : ...
0
votes
0answers
449 views

Side channel attack on FPGA AES engine

I actually don't know if this is the right place where ask, but I try. The side channel attacks aren't a negligible problem. There are several ways to protect from these attacks its own IP inside the ...
6
votes
1answer
443 views

Double-and-add/Montgomery VS blinding

I'm having a hard time understanding why people use constant-time techniques to counter time-attacks, when blinding seems as good and cheaper to implement. Why do people avoid blinding in ECC?
6
votes
2answers
542 views

power consumption in a XOR

I'm trying to understand how a XOR affect traces of power consumption in a Differential Power Analysis on smartcards. What's the difference in energy radiated in a $1 \oplus 1$ and in a $0 \oplus 1$? ...
9
votes
1answer
3k views

What is “Blinding” used for in cryptography?

What does "blinding" mean in cryptography, and where do we usually use it? Can you describe a sample implementation?
5
votes
3answers
530 views

Attack against modular inversion operation using side-channels?

I'm building a device that performs a modular inversions using a secret modulus. I would like to know if it is possible to recover all or part of this modulus by side-channels (timing, power, EMR, etc....
10
votes
2answers
161 views

Information-theoretic bound on leakage by timing measurement

I'm looking for an information-theoretic bound on leakage by timing measurement. I'm assuming that an attacker wants to leak out of a black box a secret key of $k$ bits that is secretly injected into ...
0
votes
0answers
251 views

side channel attacks against TDES (compared to AES)

We all know AES has some pretty strong side channel attacks, some where (with a couple of hundred know plain- and ciphertext combinations) a key can be derived in a matter of minutes. Others may take ...
0
votes
2answers
1k views

Practical Attack on RSA

Currently I am designing an RSA based application, and I am thinking of how long should the key be in order to be secure against attacks. I know that RSA 4096 bit key can be recovered using Sound ...
1
vote
1answer
1k views

Defence against timing attacks

I know this is a difficult subject but would a good defense against timing attacks be not sending a message if the decryption or authentication fails? So if the attacker provides a wrong HMAC for ...