4
Is an implementation without any lookup tables resistant to side-channel ?
That's only answerable by no unless it is added some limitation to the attack capabilities of adversaries. No implementation of cryptography involving a secret is resistant to sufficiently advanced side channel-attack. What was resistant a decade ago is no longer now, that's been ...
3
I see the following security issues:
The essential purposely-slow password-to-key transform is PBKDF2-HMAC. That's better than nothing, but among the better-than-nothing that's one of the worse from the standpoint of resistance to hardware-assisted password cracking (using GPUs, FPGAs, or ASICs). Nothing lesser than scrypt or Argon2 is recommendable ...
2
I assume the question is 'suppose you had an AES implementation that uses a precomputed SBOX table (and no other tables); can we do a key recovery attack using a timing or cache side channel?'
The answer to that question is "yes (at least potentially; we have to make some assumptions on the CPU hardware; at the very least, if it actually does have a ...
1
I'm not aware of websites providing a detailed comparison. Note, in particular, that DP-3T is not one, but three different proposals, and the Google-Apple system is an API specifying structural requirements for a contact tracing app, rather than a full-fledged application.
However, the DP-3T white paper is fairly detailed and explains in a very readable way ...
1
To answer my own question, after some research and experimentation I came up with a fast algorithm to break such constructions (in fact the approach below works even if the increment $C$ is unknown).
As a preprocessing step, find a set of $m$ small weights $\lvert w_i \rvert < W$ such that
$$\sum_{i = 1}^{m} w_i A^i \equiv 0 \pmod{2^{n/2 + k}} \tag{1}$$
...
Only top voted, non community-wiki answers of a minimum length are eligible
