Questions tagged [side-channel-attack]
attacks using information leaked by implementations of cryptographic algorithms to obtain information about keys or (plaintext) data, instead of (or additional to) using cryptographic weaknesses.
165
questions
4
votes
1answer
858 views
How to analyse traces of a hardware AES implementation?
I am trying to implement the correlation power analysis attack. I have a hardware AES for which I found a trigger which defines the start of the AES calculations. After that I performed an EM curves ...
11
votes
3answers
2k views
Does AES-NI offer better side-channel protection compared to AES in software?
Does AES-NI offer better side-channel protection compared to AES in software? Also, it would be great of you could provide according references in your answer.
2
votes
0answers
168 views
AES-128: How to find cipherkey comparing wrong and right ciphertexts?
I have a .mat file which contains 10 plaintexts and 10 ciphertexts which are correctly encrypted with AES-128 algorithm. It also contains 10 more ciphertexts which are wrongly encrypted. The fault is ...
3
votes
1answer
143 views
Is having AES tables on a distinct physical page enough to avoid cache timing attacks?
Reading about typical cache timing attacks, they seem to be based on intentional eviction of cache lines and timing how long an operation takes. It seems as if those attacks rely upon these tables ...
9
votes
2answers
2k views
Why are side channel attacks such as SPA/DPA/ CPA based on the AES SubBytes routine?
I have three questions about AES related to side channel attacks:
Why are side channel attacks such as CPA related to the non-linearity of the SubBytes routine within AES?
What is the difference ...
3
votes
1answer
2k views
Side Channel Attacks
How to make cipher resist against Side channel Attacks. Specially Timing Attack, Cachet Timing Attach, Simple/ Differential Power Analysis.
Uptil now it seems all Standard Algorithms like AES, ...
2
votes
0answers
263 views
Side-channel attacks for ARM conditional instructions
I'm implementing some cryptographic functions on an ARM Cortex-M4 and would like to be safe against side-channel attacks, like power and timing attacks. For efficiency I'd like to use conditional ...
7
votes
3answers
651 views
Why should we consider the output of the AES s-box as a āsensitive valueā in relation to side channel attacks?
In general, we consider the output of s-box in AES as a āsensitive valueā in order to perform a side channel attack. I would be very grateful if you could explain to me the reason of that ...
2
votes
1answer
70 views
Higher-Order Side Channel Security and Mask Refreshing: linear function?
I currently read about this paper:
https://eprint.iacr.org/2015/359.pdf
and I wanted to implement Algorithm 4 / Algorithm 5 on my own. There is one thing I cannot understand: where does function g ...
13
votes
1answer
3k views
Why not use `<`, `>` or `==` in constant time comparison?
I am comparing secret data stored in arrays a and b to see which holds a greater value. My current (pseudo)code looks like this:...
2
votes
1answer
666 views
Compression-Ratio Side Channel
I'm working through the matasano crypto challenges, and I'm onto set 7, where they describe an attack on encryption/compression oracles. I am having trouble understanding the attacks, more so the ...
7
votes
1answer
420 views
AES sbox security issue - power analysis attack?
I was wondering about whether the usage of a precomputed sbox (kind of a lookup table) could be a serious security issue when using AES.
I am new to power analysis attacks, so it is hard to ...
3
votes
2answers
81 views
Are there some well-known crypto APIs that leak information?
Are there any well-known crypto APIs or libraries that leak or used to leak information (it can be the key or anything else)?
13
votes
1answer
1k views
Is it possible to test implementation for side-channel attacks?
When it comes to implementing cryptographic algorithms, there seems to be a big focus on the difficulty of doing so without introducing the potential for side channel attacks and the knowledge ...
4
votes
1answer
226 views
FHE Block ciphers' usage
There are currently FHE implementation for
AES
Simon
Speck, and may be more.
Except for speed testing, amortized or not, one meaningful usage is mitigating form side channel analysis. Intel, AMD, or ...
9
votes
2answers
485 views
Conditions for a successful Differential Power Analysis attack
From this paper, there are two conditions for a successful DPA attack:
i) there exists an intermediate variable in the implementation that is correlated with the power consumption and
ii) this ...
4
votes
1answer
706 views
How can bit slicing be constant time, when Mix Columns is in the cipher
I'm reading about bit-slicing techniques, and one thing about it caught my mind.
The strength with bit sliced implementations are (apart from that they are fast) that they are running in constant ...
8
votes
0answers
128 views
Software timing attack using Kocher method
What's the minimum number of random sample points needed in Kocher's timing attack, so that we can determine enough valid measurements of $A_{i,r}$ and $D_{i,r}$?
I'm working from this paper: Volker ...
7
votes
2answers
637 views
How does the split mask countermeasure work on AES?
I am trying to understand the split mask countermeasure which is a masking method to avoid side channel attacks. Let's first describe the principle and then try to apply it to AES.
I found this paper ...
4
votes
1answer
405 views
Exposed raw RSA private key operation
Assume that there is a smartcard or other hardware token that exposes the raw RSA private key operation (modular exponentiation, with or without CRT parameters). Is there any possibility that raw RSA ...
5
votes
1answer
62 views
Is it okay to use a variable-time RSA implementation to verify TLS certificates?
RSA as implemented by OpenSSL et al. needs to protect against side channel attacks, at a big performance penalty.
However, TLS certificate validation involves no secrets. Therefore, I should be able ...
4
votes
1answer
106 views
Is rubberhose cryptanalysis a sidechannel - formally?
I recently was engaged in a discussion in Sec.SE where somebody used the term "sidechannel" to actually mean "circumvent the encryption".
By what he said it was clear, that he wanted to not bother ...
2
votes
1answer
174 views
How to test an encryption against different attacks [closed]
For the last while I have been reading up on cryptography and the different kinds of methods for encryption (public key, blocks, etc) and the attacks against them. This got me wondering how to ...
4
votes
1answer
421 views
ChaCha20 immune to timing attacks
What are the reasons because of which ChaCha20 is immune to timing attacks ? Also why is not AES immune to timing attacks?
9
votes
1answer
672 views
Side channel security of HMAC in software
Assume we have a processor with a symmetric co-processor that supports AES. This processor does however not provide co-processor support for hash algorithms such as SHA-1 or SHA-256.
I've got the ...
2
votes
2answers
231 views
Are there any disadvantages of using libsodiums helpers for en-/decoding/comparision instead of the native ones?
Libsodium has some helpers, which allow hexdecimal decoding, encoding and also constant-time string comparison.
So if you use the php binding libsodium-php you ...
5
votes
1answer
115 views
Optimal same-base exponentiation?
I've (finally) implemented the answer to this question in our library, which stated how to transform montgomery curves (and points) to weierstrass curves (and points).
Now, for scalar multiplication, ...
2
votes
1answer
1k views
How does constant-time comparison work?
libsodium has a method for comparing two byte sequences in constant time.
Is the idea here to simply avoid early-out if a difference in the data is detected?
When I first heard of such a thing I ...
5
votes
1answer
407 views
Which precautions to protect against side-channel attacks on ARX ciphers?
In recent crypto there has been a trend to design ciphers using only the ARX set of instructions - i.e. additions (modulo $2^{32}$ or $2^{64}$), rotations (by a fixed constant) and XORs, examples ...
13
votes
1answer
2k views
Why do crypto libs use table lookups when they're vulnerable to timing attacks?
AESEngine.java, from BouncyCastle, uses table lookups as does aes_x86core.c, in OpenSSL. But per Cache-timing attacks on AES table lookups like what OpenSSL and BouncyCastle are doing are vulnerable ...
3
votes
1answer
113 views
Can string lookups be vulnerable to timing attacks like array lookups are?
Per āCan non-assembly crypto libraries truly be secure against timing attacks?ā, array lookups are vulnerable to timing attacks. Like, if you do cresult[map[i]] and ...
1
vote
1answer
2k views
How can a lattice attack be applied to ECDSA signatures?
The aim is to check if it is possible to break the ECDSA cryptosystem under the following criteria.
Suppose that each ECDSA signature is generated by using the GLV method for point multiplication (...
0
votes
0answers
449 views
Side channel attack on FPGA AES engine
I actually don't know if this is the right place where ask, but I try. The side channel attacks aren't a negligible problem. There are several ways to protect from these attacks its own IP inside the ...
6
votes
3answers
1k views
Is there a cryptographic algorithm which is immune to side channel attacks?
Is there any cryptographic algorithm immune to side channel attacks based on scan chain? In VLSI point of view.
3
votes
1answer
614 views
DPA Attack on HMAC SHA-256
I have read the paper Differential Power Analysis of HMAC SHA-2
in the Hamming Weight Model and I want to understand the DPA Attack. In section 3.2.1 Path 1 (page 4) there is written:
The last ...
6
votes
1answer
449 views
Double-and-add/Montgomery VS blinding
I'm having a hard time understanding why people use constant-time techniques to counter time-attacks, when blinding seems as good and cheaper to implement.
Why do people avoid blinding in ECC?
0
votes
0answers
251 views
side channel attacks against TDES (compared to AES)
We all know AES has some pretty strong side channel attacks, some where (with a couple of hundred know plain- and ciphertext combinations) a key can be derived in a matter of minutes. Others may take ...
10
votes
2answers
161 views
Information-theoretic bound on leakage by timing measurement
I'm looking for an information-theoretic bound on leakage by timing measurement. I'm assuming that an attacker
wants to leak out of a black box a secret key of $k$ bits that is secretly injected into ...
1
vote
1answer
1k views
Defence against timing attacks
I know this is a difficult subject but would a good defense against timing attacks be not sending a message if the decryption or authentication fails? So if the attacker provides a wrong HMAC for ...
0
votes
2answers
1k views
Practical Attack on RSA
Currently I am designing an RSA based application, and I am thinking of how long should the key be in order to be secure against attacks. I know that RSA 4096 bit key can be recovered using Sound ...
4
votes
2answers
259 views
Power analysis and exponentiation by squaring
I am trying to understand how one can retrieve the secret exponent via a simple power analysis.
Lets suppose that the exponentiation by squaring algorithm is implemented in its simplest form :
...
6
votes
2answers
556 views
power consumption in a XOR
I'm trying to understand how a XOR affect traces of power consumption in a Differential Power Analysis on smartcards.
What's the difference in energy radiated in a $1 \oplus 1$ and in a $0 \oplus 1$?
...
2
votes
1answer
1k views
The Boneh-DeMillo-Lipton fault attack (RSA CRT)
I am trying to understand the Boneh-DeMillo-Lipton fault attack on RSA CRT signature.
Suppose that we sign a message $m$ with RSA-CRT :
$d_p = d \bmod (p-1)$ and $d_q = d \bmod (q-1)$
$s_p = h(m)^{...
3
votes
1answer
156 views
Protection of Elliptic Curve Implementations against side-channel attacks [closed]
Recent fast elliptic curve implementations, for example a presentation at Eurocrypt 2014 (earlier presentation slides, the paper) talks about protection against only timing attacks. Why only timing ...
1
vote
1answer
646 views
side channel attacks on AES
Say you have a web application that's performing AES encryption. What sorts of side channel attacks should one keep an eye out for?
Timing attacks affect RSA more than symmetric ciphers in-so-far as ...
4
votes
1answer
254 views
How did the power measurements translate to AES Key?
A side channel attack is described here.
I did not quite get , how the power measurements are used to get the
decryption key , can any body explain it?
6
votes
1answer
332 views
Understanding Genkin-Pipman-Tromer's ground potential, side channel attack on RSA
I'm pretty sure that by now folks might have come across this research from Genkin-Pipman-Tromer (GPT) on extracting the RSA key used by GnuPG (GPG) just by measuring the ground potential. I'm going ...
7
votes
1answer
3k views
Montgomery Ladder vs Double-and-Add
I would like to know what (if any) are the advantages of using Montgomery Power ladder over the Double-and-Add-Always algorithm.
I think that firstly, Monty would be slightly faster than DoubleAndAdd. ...
2
votes
1answer
230 views
/dev/random only needed for key generation / CPU pattern encryption
Consider the following scenarios:
using OpenSSL to encrypt a file with Rijndael-256
using LUKS to encrypt a hard-drive that is used every day
Exactly when is entropy from ...
5
votes
3answers
539 views
Attack against modular inversion operation using side-channels?
I'm building a device that performs a modular inversions using a secret modulus. I would like to know if it is possible to recover all or part of this modulus by side-channels (timing, power, EMR, etc....
