A side channel attack is an attack that deduces secret information from environmental observations such as timing or power consumption.

learn more… | top users | synonyms

6
votes
5answers
372 views

Origin of side-channel attacks

What is the origin of side-channel attacks? Is it related to the algorithm or to the implementation? In other words, is the software responsible for the attack or the hardware? Is there a ...
0
votes
3answers
86 views

Constant time compares when array sizes are not equal?

What is the preferred or recommended way to pursue contestant time compares when array lengths are not equal? Should we exit as early as possible? Something like: if (array1.size() != array2.size()) ...
1
vote
1answer
44 views

Are servers that do not implement time services vulnerable to clock skew attacks?

An article describes clock skew attack possibilities §§: These can be attacked by repeatedly connecting to the hidden service, causing its CPU load, hence temperature, to increase and so ...
3
votes
1answer
142 views

Do we have to take algorithm substitution attacks seriously?

Bruce Schneier's blog drew my attention to algorithm substitution attacks which may leak symmetric keys through IV or padding or other covert channels, encrypted with escrow keys. The major premise is ...
1
vote
2answers
119 views

Password prompt before en-/decryption to prevent Side Channel Attacks on FPGA?

When we are using a FPGA for file, container or full-disk encryption, we need to input a password for encryption/decryption process. How can we prevent side channel attacks to steal password for a ...
0
votes
2answers
131 views

side channel attacks - powered off system with physical access

Can you run Side-Channel-Attacks against a PC which was found properly shutdown and powered off? The attacker knows the cryto-tools used to encrypt the data. The attacker has full and unlimited ...
17
votes
5answers
1k views

Timing Safe String Comparison - Avoiding Length Leak

Let's say that we're building a generic timing-safe comparison function for general purpose use. Making it so that it is safe when both strings are equal length is pretty well known. However, what I'm ...
15
votes
2answers
699 views

RSA key recovery using sound - How does it work?

A very interesting Debian security advisory was released yesterday. Genkin, Shamir and Tromer discovered that RSA key material could be extracted by using the sound generated by the computer ...