# Tag Info

44

The normal way is to keep secret data in volatile static RAM (i.e. 6 transistors per bit, like in current CPU caches, not with capacitors like in DRAM). When the power is cut, the data is gone in a matter of microseconds. The HSM contains a small battery to keep the RAM up and running for up to a few weeks. The battery also powers an array of sensors, e.g. ...

40

1 - How feasible is it that the chip's manufacturer can predict the output of this PRNG when it passed tests from the people applying the use of this RdRand instruction in kernels? A strong stream cipher's output is random and unpredictable to anyone not knowing the key. See where this is heading? Just because something looks random doesn't mean it's random....

25

In general, no. Let us say you have a data vector $x$ of $k$ bits and one bit is flipped by an error. There is no way of detecting, let alone correcting this, unless the errored data vector $x'$ is not another valid data vector. If the errored vector $x'$ is not a valid data vector and you can do detection, then all $k$ bits cannot be used as arbitrary ...

22

It is not physically impossible to retrieve data, merely very difficult. Physical sensors such as light sensors and mesh layers on chips can be bypassed. Christopher Tarnovsky's work using a Focused Ion Beam (FIB) electron microscope is worth a watch. IIRC the FIB he's using cost him somewhere around \$500,000 used, over 10 years ago. Renting time on one ... 17 Let me begin by saying that if you have a hardware source of randomness, you don't need to be stingy with it. 1) Does modulo affect the quality of randomness, faking in some way the distribution of values? Yes, it does. Or at any rate, it can --- see my answer to (3) below for more details. (I'm assuming by "quality of randomness", you specifically mean ... 15 Have you heard of the strange story of Dual_EC_DRBG? A random number generator suggested and endorsed by the government that exhibits some very suspicious properties. http://www.schneier.com/blog/archives/2007/11/the_strange_sto.html From that article: This is how it works: There are a bunch of constants -- fixed numbers -- in the standard used to define ... 15 There are two important differences between AES-128 and AES-256: AES-128 has 10 rounds, AES-256 has 14 The key expansion process (that is, how they generate subkeys) is different If your AES-128 encryption hardware just takes a plaintext block and a 128 bit key, and produces a ciphertext block, well, no, there's not much you can do. In this case, the ... 15 In practice, AES encryption mostly use CTR mode or some authenticated encryption, and in these the block cipher itself is only used for encryption. There is thus often no need to implement AES decryption in hardware. We can always remove features from hardware circuitry. Implementing only the AES encryption sizably reduce the hardware cost (compared to also ... 13 Hardware implementations are common, and likely to become more common as security needs increase, rather than less common. One place they're used is in the digital signature of messages, such as messages going to/coming from a Smart Card used for banking. Those are tiny, slow, limited processors, and a hardware implementation has the potential to improve ... 13 These are the AES-NI instructions listed by wikipedia: AESENC: Perform one round of an AES encryption flow AESENCLAST: Perform the last round of an AES encryption flow AESDEC: Perform one round of an AES decryption flow AESDECLAST: Perform the last round of an AES decryption flow AESKEYGENASSIST: Assist in AES round key generation AESIMC: Assist ... 12 1 - How feasible is it that the chip's manufacturer can predict the output of this PRNG when it passed tests from the people applying the use of this RdRand instruction in kernels? As nightcracker correctly stated, any strong cryptographic PRNG will produce a stream of numbers that pass statistical tests. However, the manufacturer has some constraints: ... 12 There are typically four different settings where you want to run your crypto. The Central Processing Unit (CPU). This may be a classic desktop or laptop CPU or the one of your embedded device. Its characteristic is that it usually has rather few computation cores ( < 20), but it can use the ones it has very fast and can execute arbitrary instructions (... 11 I am the designer of the random number generator that is behind the Intel RdRand instruction. How feasible is it that the chip's manufacturer can predict the output of this PRNG when it passed tests from the people applying the use of this RdRand instruction in kernels? It isn't. We cannot. It passes the tests because it is a cryptographically ... 11 To my knowledge there are at least 4 ways to implement AES. I. lookup tables For simple blocs, lookup tables are fast but they are sensible to timings attacks. Here is an example of lookup table implementation: b0 = T0[ a0 >> 24 ] ^ T1[(a1 >> 16) & 0xff] ^ T2[(a2 >> 8) & 0xff] ^ T3[ a3 & 0xff] ^ rk[4]; b1 = T0[ a1 >> ... 11 A TRNG is never used instead of a CSPRNG. They serve different purposes. A TRNG is used to seed a CSPRNG. A CSPRNG alone isn't enough to generate random data since it's reproducible. A hardware entropy source alone isn't enough to generate random data because all entropy sources have biases. For any purpose that's related to security or cryptography, a ... 10 A cryptographical algorithm can't be immune or not immune to side channel attacks; this is because a side channel attack attacks the implementation and not the actual algorithm. Any algorithm that uses secret data can be implemented in a way that has side channel attacks, and any algorithm can be implemented in a way that may be resistant (the hard-core ... 10 It basically depends on what you consider side-channel attacks. If you consider time/cache side channel attacks than chacha20 has been design with resistance to such attacks in mind while AES didn't. In fact, AES is vulnerable to these kind of attacks (as they were invented after AES was designed). But, hardware implementations, such as AES-NI are ... 9 It depends how the “AES-128 encryption hardware units” you mention are actually defined. I've already encountered processors that allow to independently compute AES operations such as$\texttt{SubBytes}$and$\texttt{MixColumns}$– which are the same regardless the key size involved (128 or 256 bits). In that case: yes, it can speed up the calculation for ... 9 How NIST's ECC curves (P256 alias secp256r1 and friends) have been generated is public: that's in SEC2v1 (with reference to the "verifiably random" method of ANSI X9.62-1998, a draft of which is here), including the seed of the SHA-1-based PRNG used; however, how that seed was chosen is not public, and it's anyone's guess if that's just lost or if something ... 9 No, because of the Pigeonhole Principle. Let's say you want to be able to send arbitrary$k$-bit messages. There are$2^k$possible bit-patterns, and$2^k$possible intended messages. Now let's say you want to add error correction. This means that, on top of the$2^k$correct messages that you want to be able to send, you also want to be able to send some ... 8 A video camera can obtain entropy, but only at a fairly low rate and only if allowed to see "unusual" scenes… like someone making funny faces, unusual movements, etc. Of course, this only works in a room with no video bugs. Theoretical explanations… Depending on your knowledge-range, the following sources may be able to explain ways webcams can be used ... 8 Your doubts are absolutely valid. Disguising the algorithm is not a valid argument for security. It also contradicts to Kerckhoffs Law. It (the algorithm) should not require secrecy, and it should not be a problem if it falls into enemy hands; Designing cryptographic algorithms (ciphers, hashfunctions, ...) is a long and complicated process. In academia ... 8 A company can make more money if the printers it sells only work with the cartridges they sell, which does not work if there is competition. It's cheaper to force a vendor lock-in than it is to innovate and ensure that your product holds up to the competition. All the printer's authentication does is prevent you from using cartridges made by other companies. ... 7 As pointed in this comment, using a huge random key for a sound block cipher is an excellent defense to resist ASIC/GPU attacks. Each bit added doubles the effort required. If an adversary was able to build$10^{12}$ASICs each capable of testing$10^{12}$keys per second, odds of finding a 128-bit key by brute force running that for a decade are less than ... 7 I think this question is setting up a false dichotomy. It's not that a researcher has an opinion as to whether they prefer software or hardware implementations. The choice of implementation depends on the requirements of the specific cryptosystem you're building. For example, if you're designing a system to encrypt voice traffic on a mobile phone network, ... 7 First, take note of my answer to the question Estimating bits of entropy. A key phrase therein: You'll never be able to look at a bitstream without knowing the distribution and say "there are X bits of entropy here." The ent program doesn't know the distribution of the data it's looking at; instead it performs some statistical tests that any sufficiently-... 7 The problem with CPU jitter is that it is difficult to pin down an accurate physical model of it that would allow you to calculate the entropy involved. Therefore entropy estimates have to largely be grounded on statistical testing, as in the document I linked in the comments. As you may know, statistical testing alone can only ever give you an upper bound ... 7 Let's focus on DSA. The signing on a message$m\in \mathbb{Z}_q$for the suggested "no-hash" protocol is done as follows: Pick$k\in_R \mathbb{Z}_q$, compute$r=f(g^k)$, where$f(\cdot):=(\cdot \bmod p) \bmod q$. Compute$s=k^{-1}(m+xr)\bmod q$Return$(r,s)$if the signature is not degenerate. The verification algorithm, on input$(m,s,r)$, checks if$f((...

7

Yes, those encoded values are $r$ and $s$. The ASN.1 integers are signed big endian values while the two fixed sized values are unsigned big endian. So the value field may be identical or it may not, if: the value is equal to or larger than $2^{256 - 1}$: encoding this as signed big endian value will result in an additional byte at the left set to 00 to ...

6

The access codes were recently leaked (by whom, I don't know). My Yubikey is listed and I can confirm that the access codes were necessary and sufficient to reprogram it. You can change or remove the access code as part of reprogramming too. The leak doesn't make the Yubikeys useless in the extremely unlikely event of Gox rising from the flames — no ...

Only top voted, non community-wiki answers of a minimum length are eligible