4

Is an implementation without any lookup tables resistant to side-channel ? That's only answerable by no unless it is added some limitation to the attack capabilities of adversaries. No implementation of cryptography involving a secret is resistant to sufficiently advanced side channel-attack. What was resistant a decade ago is no longer now, that's been ...


3

I see the following security issues: The essential purposely-slow password-to-key transform is PBKDF2-HMAC. That's better than nothing, but among the better-than-nothing that's one of the worse from the standpoint of resistance to hardware-assisted password cracking (using GPUs, FPGAs, or ASICs). Nothing lesser than scrypt or Argon2 is recommendable ...


2

I assume the question is 'suppose you had an AES implementation that uses a precomputed SBOX table (and no other tables); can we do a key recovery attack using a timing or cache side channel?' The answer to that question is "yes (at least potentially; we have to make some assumptions on the CPU hardware; at the very least, if it actually does have a ...


1

I'm not aware of websites providing a detailed comparison. Note, in particular, that DP-3T is not one, but three different proposals, and the Google-Apple system is an API specifying structural requirements for a contact tracing app, rather than a full-fledged application. However, the DP-3T white paper is fairly detailed and explains in a very readable way ...


1

To answer my own question, after some research and experimentation I came up with a fast algorithm to break such constructions (in fact the approach below works even if the increment $C$ is unknown). As a preprocessing step, find a set of $m$ small weights $\lvert w_i \rvert < W$ such that $$\sum_{i = 1}^{m} w_i A^i \equiv 0 \pmod{2^{n/2 + k}} \tag{1}$$ ...


Only top voted, non community-wiki answers of a minimum length are eligible