Hot answers tagged

5

Can a variable that is not explicitly computed correlate with the power consumption? Yes, and this can happen in several ways. When you say "not computed explicitly", I assume you mean that the computation is performed on a masked value or share instead. That is, the secret inputs (referred to as the key by the paper you link to) themselves do not ...


4

When generating random data that is later tested for primality, should the random data include the value 0x0? I'm reading this as: should the hexadecimal expression of the primes include the hexadecimal digit 0? With hight likelihood yes. But that needs not/should not be tested. Common wisdom is that except for the few high-order bits (constrained by range ...


3

Given some intermediate data $x$ as two shares $x=x_1\oplus x_2$ take some fresh random $r$ to calculate new shares $x_1' = ((x_1\oplus r)\oplus x_2)\oplus(n\oplus r)$ [parenthesis indicating the order of evaluation] and $x_2' = n$. Now you can use $x_1'$ ($=x\oplus n$) as input for both tables. The answer to "So how should it be computed?" is not at all. ...


2

Actually, it's any $\mathbb{F}_2$-linear function you want it to be. That is, those two algorithms are generic ways, given a linear $g$ and a threshld (secret-shared) value $x$, to compute a threshold version of $x \times g(x)$ (where $\times$ is $GF(2^n)$ field multiplication).


2

The exact details depend on the logic family but basically The difference is that the charge representing those "1" bits need to be discarded somehow. This is done by switching the output to ground, 1^0 is 1 so no charge need to go away but 1^1 is zero meaning at least two gates get discharged to ground slightly raising its voltage due to the non zero ...


2

Most of side channel attacks are depends on algorithm and implementation. In several cases, power consumption is evidently visible in algorithm. For example in the algorithm for elliptic curve points multiplication, for computing $Q=k\cdot P$ we have following algorithm: Let $k$ be $l$ bit. Q=P for i from l-1 to 0 do Q = 2Q if k_i == 1 then Q = Q+P ...


2

I did not paid attention enough when reading the paper. The figure 2 illustrates the operation: So after the computation of $S'$ and $M$, at the first round, the $\texttt{AddRoundKey}$ step stay the same but in addition, the round key is xored with $n$. So if the block data is $x$, after the first $\texttt{AddRoundKey}$ we get $x \oplus k \oplus N$ (where $...


2

I'm not an expert yet, but this is how I remember it. DPA or differential power analysis is a side-channel attack on hardware implementations of cryptographic algorithm. All electronic circuits consume different amount of power depending on the activity of individual transistors. For example, more transistors may switch when adding the hexadecimal bytes A7 ...


2

The Pearson product-moment correlation coefficient is what you evaluate, in general, when you perform DPA (CPA would be a better name for this, but DPA is used also in this context). It is defined as: $\rho(X,Y) = \frac{cov(X,Y)}{\sigma_X\sigma_Y}$ Where $X,Y$ are your vectors, $cov$ is the covariance and $\sigma_X$ is the standard deviation of X. In your ...


2

There seems to be not many effective DPA attacks against SHA How do you come to that conclusion? Is it because there aren't many published results of using DPA attacks against SHA? Well, that's mostly because SHA is most often used to hash publicly available data, and so there's less of a point using a DPA attack to recover that data. Now, any side ...


2

The, common, assumption used in that paper is that an attacker can DPA a fixed secret when it's mixed with known (to the attacker) and varying data. The proposed solution was to add random after the key to fill the SHA-512 block size. By doing this: the first SHA-512 computation processes the fixed secret and varying but unknown data, so the attacker can'...


2

I would have thought that primes that do not include zero's are a subset of the set of primes that do - and therefore make keys generated with no zero's easier to brute force? If you mean by brute force factorization, keeping a list of prime and test them, I should say why only 0x0, this contains 4 zeros, then 0x87 and 0x42 are containing 4 zeroes, too. ...


1

You should use the value you found (in watt). Try to have a look at this file, it's really well explained in my opinion. If you look for page 21 for instance, you'll see that the plaintext produces a certain waveform; then, after the hypotesis and the S-Box output, the correlation is clearly done with the power model obtained and the value of the traces (...


1

I will keep the same notations as in the paper mentioned above. First, your substitution for $H^{(0)}$ is correct but you could stop to \begin{align*} T_1^{(1)} = H^{(0)}\boxplus \Sigma_1(E^{(0)}) \boxplus Ch(E^{(0)}, F^{(0)}, G^{(0)}) \boxplus K_1 \boxplus W_1 \end{align*} since all values except $H^{(0)}$ are known from previous DPAs. Regarding $C^{(0)}$,...


Only top voted, non community-wiki answers of a minimum length are eligible