53 votes
Accepted

How are side-channel attacks executed? What does an attacker need to execute a side channel attack?

Here's a very simple timing side channel attack that you might even see in movies. Suppose you're trying to log in to a computer with a password, and the victim compares your password byte by byte ...
user avatar
34 votes
Accepted

Why use argon2i or argon2d if argon2id exists?

The current Argon2 draft RFC, I think, provides a good, reasonably brief answers to this question. TL;DR: most people will indeed want to use Argon2id and not the "pure" variants. The ...
user avatar
28 votes
Accepted

Why not use `<`, `>` or `==` in constant time comparison?

C comparison operators (strictly relational < <= > >= and equality == !=) yield 1 if the condition is satisfied and ...
user avatar
25 votes
Accepted

How to confirm my implementation is constant time

How to confirm my implementation is constant time? I'm in scala using bouncy castle from Java. This code is not constant time, for no platform is specified. Computing platforms that run in constant ...
23 votes
Accepted

How to avoid side channel attacks when handling large numbers?

I recently wrote a big page on how big integers are implemented in BearSSL. There are several ways to represent integers in RAM and compute operations on them; also, note that for cryptography, we ...
user avatar
22 votes
Accepted

Does AES-NI offer better side-channel protection compared to AES in software?

Yes, AES-NI was specifically designed to be constant-time and thus offers better side-channel protection than (some) software implementations. Note however that these day there exist quite fast side-...
user avatar
  • 44.6k
22 votes
Accepted

Timing-Safety in JVM-Languages

The theory is: don't try to write timing-safe code in JVM-languages or other essentially-interpreted-but-perhaps-sometime-compiled languages; rather Use timing-safe libraries called from the comfort ...
user avatar
  • 122k
20 votes

How are side-channel attacks executed? What does an attacker need to execute a side channel attack?

This is an attempt to an Explain to me like I'm five style answer: Assume you have a bank vault with a mechanical combination lock. Your cipher in this case is "combination lock". At first sight it ...
user avatar
  • 301
18 votes

Timing-Safety in JVM-Languages

Writing constant-time cryptographic code is certainly possible in Java or similar languages (e.g. C#). However you have to do it properly. "Constant-time" here means that the observable time-related ...
user avatar
17 votes

Can deterministic ECDSA be protected against fault attacks?

As already said by fgrieu in his answer, this is possible. There are multiple ways to protect deterministic ECDSA against fault attacks, but these ways will depend on your fault model. If you consider ...
user avatar
  • 7,163
16 votes
Accepted

Why do crypto libs use table lookups when they're vulnerable to timing attacks?

I believe that it is for two reasons: Nontable based implementations of AES are possible, but (assuming you don't have AES-NI or something similar) are significantly slower than table based ...
user avatar
  • 131k
16 votes

Does AES-NI offer better side-channel protection compared to AES in software?

With regards to timing-based side channels (those that can potentially be exploited remotely, as opposed to, say, power analysis), the AES-NI opcodes are constant-time. See for instance Intel ...
user avatar
14 votes
Accepted

If a single bit was known through all states in AES, which would cause the most information to leak?

If you are an attacker and could watch one bit of AES-128 for 10 rounds, which bit would you choose to recover the most useful information? I feel it would be a bit in the key schedule. Actually, I'd ...
user avatar
  • 131k
14 votes
Accepted

Safely sorting secret data

Yes, you can; you can use Batcher's Merge Exchange algorithm, paired with a constant time/access compare-and-swap routine (which reads two elements from locations A and B, and writes the larger ...
user avatar
  • 131k
13 votes

Why don't table lookups run in constant time?

It mostly has to do with the real world influence of memory caches. A cache is a small amount of fast memory; when you read from memory, the contents are placed in this fast memory (possibly along ...
user avatar
  • 131k
13 votes

Constant time multiplication in GF(2^8)

In C, multiplication in the field $\operatorname{GF}(2^8)$ with reduction polynomial $x^8+x^4+x^3+x+1$ can be coded as one of these three functionally equivalent functions: ...
user avatar
  • 122k
11 votes
Accepted

Does blinding work against side channel on RSA?

Blinding protects against some side-channel attacks in RSA: those that target variations in the timing or other side-channel information as a known function of $C$ (or $C^d\bmod n$ should that end up ...
user avatar
  • 122k
10 votes

Is there a cryptographic algorithm which is immune to side channel attacks?

A cryptographical algorithm can't be immune or not immune to side channel attacks; this is because a side channel attack attacks the implementation and not the actual algorithm. Any algorithm that ...
user avatar
  • 131k
10 votes
Accepted

Strength of block ciphers under attack [by government level attackers]

Obligatory XKCD: coercion (or/and bribery) works. Other usual strategies are Rigging the particular machine used by the data owner. Otherwise spying key-presses on that machine to obtain the password....
user avatar
  • 122k
10 votes
Accepted

Is ChaCha20 safer than AES with respect to side-channel attacks?

It basically depends on what you consider side-channel attacks. If you consider time/cache side channel attacks than chacha20 has been design with resistance to such attacks in mind while AES didn't. ...
user avatar
  • 6,309
10 votes

Can deterministic ECDSA be protected against fault attacks?

Yes, ECDSA (including deterministic) can be protected against fault attacks. An idea is to check any computed signature (by the verifier's algorithm) before releasing the signature (and not releasing ...
user avatar
  • 122k
10 votes
Accepted

Are there any symptoms of a side channel attack on the target chip?

Side channel attacks are variably understood as excluding or including fault attacks. Let's start with the excluding definition, where side channel attacks monitor a device running some security-...
user avatar
  • 122k
10 votes
Accepted

Why does side-channel security focus on “shielding” rather than “jamming”?

Physically speaking, the crucial quantity is the signal to noise ratio: if a little bit of signal comes out on a given channel but also a whole lot of random noise, and you have no a-priori way of ...
user avatar
  • 131k
9 votes
Accepted

Montgomery Ladder vs Double-and-Add

Actually, those two algorithms are surprisingly close; I'll write both of them up to show how close they are. They both can be written as a combination of three substeps: ...
user avatar
  • 131k
9 votes

ChaCha20 immune to timing attacks

The obvious way of implementing ChaCha20 involves nothing but additions, fixed rotations, and XORs. All of these are constant time, so the obvious way of implementing ChaCha20 is secure against ...
user avatar
  • 4,633
9 votes
Accepted

How does constant-time comparison work?

A common method for constant-time comparison goes $r←0$ for each bit/byte/word $x_i$ and $y_i$ to compare $r←r ∨ (x_i⊕y_i)$   where $∨$ stands for bitwise OR and $⊕$ stands for bitwise XOR all ...
user avatar
  • 122k
9 votes
Accepted

Is it possible to test implementation for side-channel attacks?

At least for compiled languages it should also be possible to have tools that perform static analysis on machine code, shouldn't it? Indeed, such tools exist. There are companies specialized in ...
user avatar
  • 2,674
9 votes

Why should we consider the output of the AES s-box as a “sensitive value” in relation to side channel attacks?

I would like to complete poncho's answer by mentioning a point that has not been discussed here. On top of being an internal state which directly depends on plaintexts (resp. ciphertexts) and the key ...
user avatar
  • 2,674
9 votes

Timing-Safety in JVM-Languages

Not in the least. Forget it. This is written from my experience which is with Java, but all JVM languages will have similar insurmountable problems. There are issues with compile time and run time ...
user avatar
  • 13.8k

Only top scored, non community-wiki answers of a minimum length are eligible