A side channel attack is an attack that deduces secret information from environmental observations such as timing or power consumption.

learn more… | top users | synonyms

1
vote
0answers
67 views

OpenPGP smartcards compromised by blackhat 2015 simcard hack?

This blackhat was a new sidechannel attack in the SIM-card AES encryption announced. I am currently using the OpenPGP smart/SIM-card version 2.1 to store my PGP-private keys, which is the same model ...
2
votes
0answers
63 views

How to do side channel attack on smart cards? [closed]

Assume that I have a smart card and I want to do a differential power side channel attack on its mutual authentication mechanism. This is the mutual authentication mechanism that my card using(Let ...
4
votes
3answers
85 views

Software defense against cold-boot attacks

Cold boot attacks are particularly nasty. On Android, a solution is to use a Nexus device with a locked bootloader to preven flashing a custom recovery. On a PC, your safeguards are even more ...
6
votes
5answers
419 views

Origin of side-channel attacks

What is the origin of side-channel attacks? Is it related to the algorithm or to the implementation? In other words, is the software responsible for the attack or the hardware? Is there a ...
0
votes
3answers
111 views

Constant time compares when array sizes are not equal?

What is the preferred or recommended way to pursue contestant time compares when array lengths are not equal? Should we exit as early as possible? Something like: if (array1.size() != array2.size()) ...
1
vote
1answer
57 views

Are servers that do not implement time services vulnerable to clock skew attacks?

An article describes clock skew attack possibilities §§: These can be attacked by repeatedly connecting to the hidden service, causing its CPU load, hence temperature, to increase and so ...
3
votes
1answer
176 views

Do we have to take algorithm substitution attacks seriously?

Bruce Schneier's blog drew my attention to algorithm substitution attacks which may leak symmetric keys through IV or padding or other covert channels, encrypted with escrow keys. The major premise is ...
1
vote
2answers
134 views

Password prompt before en-/decryption to prevent Side Channel Attacks on FPGA?

When we are using a FPGA for file, container or full-disk encryption, we need to input a password for encryption/decryption process. How can we prevent side channel attacks to steal password for a ...
0
votes
2answers
155 views

side channel attacks - powered off system with physical access

Can you run Side-Channel-Attacks against a PC which was found properly shutdown and powered off? The attacker knows the cryto-tools used to encrypt the data. The attacker has full and unlimited ...
18
votes
5answers
1k views

Timing Safe String Comparison - Avoiding Length Leak

Let's say that we're building a generic timing-safe comparison function for general purpose use. Making it so that it is safe when both strings are equal length is pretty well known. However, what I'm ...
15
votes
2answers
783 views

RSA key recovery using sound - How does it work?

A very interesting Debian security advisory was released yesterday. Genkin, Shamir and Tromer discovered that RSA key material could be extracted by using the sound generated by the computer ...