53
votes
Accepted
How are side-channel attacks executed? What does an attacker need to execute a side channel attack?
Here's a very simple timing side channel attack that you might even see in movies. Suppose you're trying to log in to a computer with a password, and the victim compares your password byte by byte ...
- 45.6k
34
votes
Accepted
Why use argon2i or argon2d if argon2id exists?
The current Argon2 draft RFC, I think, provides a good, reasonably brief answers to this question. TL;DR: most people will indeed want to use Argon2id and not the "pure" variants.
The ...
- 14k
28
votes
Accepted
Why not use `<`, `>` or `==` in constant time comparison?
C comparison operators (strictly relational < <= > >= and equality == !=) yield 1 if the condition is satisfied and ...
- 5,391
25
votes
Accepted
How to confirm my implementation is constant time
How to confirm my implementation is constant time? I'm in scala using bouncy castle from Java.
This code is not constant time, for no platform is specified. Computing platforms that run in constant ...
23
votes
Accepted
How to avoid side channel attacks when handling large numbers?
I recently wrote a big page on how big integers are implemented in BearSSL. There are several ways to represent integers in RAM and compute operations on them; also, note that for cryptography, we ...
- 84.5k
22
votes
Accepted
Does AES-NI offer better side-channel protection compared to AES in software?
Yes, AES-NI was specifically designed to be constant-time and thus offers better side-channel protection than (some) software implementations. Note however that these day there exist quite fast side-...
- 44.6k
22
votes
Accepted
Timing-Safety in JVM-Languages
The theory is: don't try to write timing-safe code in JVM-languages or other essentially-interpreted-but-perhaps-sometime-compiled languages; rather
Use timing-safe libraries called from the comfort ...
- 122k
20
votes
How are side-channel attacks executed? What does an attacker need to execute a side channel attack?
This is an attempt to an Explain to me like I'm five style answer:
Assume you have a bank vault with a mechanical combination lock. Your cipher in this case is "combination lock". At first sight it ...
- 301
18
votes
Timing-Safety in JVM-Languages
Writing constant-time cryptographic code is certainly possible in Java or similar languages (e.g. C#). However you have to do it properly.
"Constant-time" here means that the observable time-related ...
- 84.5k
17
votes
Can deterministic ECDSA be protected against fault attacks?
As already said by fgrieu in his answer, this is possible.
There are multiple ways to protect deterministic ECDSA against fault attacks, but these ways will depend on your fault model.
If you consider ...
- 7,163
16
votes
Accepted
Why do crypto libs use table lookups when they're vulnerable to timing attacks?
I believe that it is for two reasons:
Nontable based implementations of AES are possible, but (assuming you don't have AES-NI or something similar) are significantly slower than table based ...
- 131k
16
votes
Does AES-NI offer better side-channel protection compared to AES in software?
With regards to timing-based side channels (those that can potentially be exploited remotely, as opposed to, say, power analysis), the AES-NI opcodes are constant-time. See for instance Intel ...
- 84.5k
14
votes
Accepted
If a single bit was known through all states in AES, which would cause the most information to leak?
If you are an attacker and could watch one bit of AES-128 for 10 rounds, which bit would you choose to recover the most useful information? I feel it would be a bit in the key schedule.
Actually, I'd ...
- 131k
14
votes
Accepted
Safely sorting secret data
Yes, you can; you can use Batcher's Merge Exchange algorithm, paired with a constant time/access compare-and-swap routine (which reads two elements from locations A and B, and writes the larger ...
- 131k
13
votes
Why don't table lookups run in constant time?
It mostly has to do with the real world influence of memory caches.
A cache is a small amount of fast memory; when you read from memory, the contents are placed in this fast memory (possibly along ...
- 131k
13
votes
Constant time multiplication in GF(2^8)
In C, multiplication in the field $\operatorname{GF}(2^8)$ with reduction polynomial $x^8+x^4+x^3+x+1$ can be coded as one of these three functionally equivalent functions:
...
- 122k
11
votes
Accepted
Does blinding work against side channel on RSA?
Blinding protects against some side-channel attacks in RSA: those that target variations in the timing or other side-channel information as a known function of $C$ (or $C^d\bmod n$ should that end up ...
- 122k
10
votes
Is there a cryptographic algorithm which is immune to side channel attacks?
A cryptographical algorithm can't be immune or not immune to side channel attacks; this is because a side channel attack attacks the implementation and not the actual algorithm. Any algorithm that ...
- 131k
10
votes
Accepted
Strength of block ciphers under attack [by government level attackers]
Obligatory XKCD: coercion (or/and bribery) works. Other usual strategies are
Rigging the particular machine used by the data owner.
Otherwise spying key-presses on that machine to obtain the password....
- 122k
10
votes
Accepted
Is ChaCha20 safer than AES with respect to side-channel attacks?
It basically depends on what you consider side-channel attacks.
If you consider time/cache side channel attacks than chacha20 has been design with resistance to such attacks in mind while AES didn't. ...
- 6,309
10
votes
Can deterministic ECDSA be protected against fault attacks?
Yes, ECDSA (including deterministic) can be protected against fault attacks. An idea is to check any computed signature (by the verifier's algorithm) before releasing the signature (and not releasing ...
- 122k
10
votes
Accepted
Are there any symptoms of a side channel attack on the target chip?
Side channel attacks are variably understood as excluding or including fault attacks. Let's start with the excluding definition, where side channel attacks monitor a device running some security-...
- 122k
10
votes
Accepted
Why does side-channel security focus on “shielding” rather than “jamming”?
Physically speaking, the crucial quantity is the signal to noise ratio: if a little bit of signal comes out on a given channel but also a whole lot of random noise, and you have no a-priori way of ...
- 131k
9
votes
Accepted
Montgomery Ladder vs Double-and-Add
Actually, those two algorithms are surprisingly close; I'll write both of them up to show how close they are.
They both can be written as a combination of three substeps:
...
- 131k
9
votes
ChaCha20 immune to timing attacks
The obvious way of implementing ChaCha20 involves nothing but additions, fixed rotations, and XORs. All of these are constant time, so the obvious way of implementing ChaCha20 is secure against ...
- 4,633
9
votes
Accepted
How does constant-time comparison work?
A common method for constant-time comparison goes
$r←0$
for each bit/byte/word $x_i$ and $y_i$ to compare
$r←r ∨ (x_i⊕y_i)$ where $∨$ stands for bitwise OR and $⊕$ stands for bitwise XOR
all ...
- 122k
9
votes
Accepted
Is it possible to test implementation for side-channel attacks?
At least for compiled languages it should also be possible to have
tools that perform static analysis on machine code, shouldn't it?
Indeed, such tools exist. There are companies specialized in ...
- 2,674
9
votes
Why should we consider the output of the AES s-box as a “sensitive value” in relation to side channel attacks?
I would like to complete poncho's answer by mentioning a point that has not been discussed here.
On top of being an internal state which directly depends on plaintexts (resp. ciphertexts) and the key ...
- 2,674
9
votes
Timing-Safety in JVM-Languages
Not in the least. Forget it.
This is written from my experience which is with Java, but all JVM languages will have similar insurmountable problems. There are issues with compile time and run time ...
- 13.8k
Only top scored, non community-wiki answers of a minimum length are eligible