3

I'm doing an Extended Essay for IB right now and I'm doing it on how secure RSA is.

As side-channel attacks are one category of attack, I was wondering (as I am struggling with the conclusion) while there are countermeasures, is it true that most of them do not offer absolute privacy, but rather they only reduce risk? Are there any absolute solutions to any existing side channel attacks?

Since these countermeasures are not widely known to the general public, is it true that people may not employ those measures. Is it also true that most consumer standard devices usually don't have these measures built into them?

2

is it true that most of them do not offer absolute privacy, but rather they only reduce risk?

No, many of them completely eliminate the risk. Using constant time implementations of algorithms and not branching on secret-dependent conditions ensures that secrets being processed provably have no effect on timing, making such side-channel attacks impossible. Some cryptographic algorithms, like Ed25519, are designed to make implementations with comprehensive side-channel resistance in mind possible and practical. In other cases, the hardware itself is designed to make side-channel attacks difficult to pull off. AES-NI in many modern x86 processors is one example of that. It is an instruction set which provides acceleration for AES encryption and additionally runs in constant time.

Are there any absolute solutions to any existing side channel attacks?

For some classes of side-channel attacks such as those based on timing, yes. See above. For the more advanced attacks that involve things such as differential power analysis, there is very often no way to completely avoid them, short of using specialized microprocessors designed specifically for security, such as those used in Hardware Security Modules (HSMs). Cheap consumer electronics are unlikely to take such measures as they bring the base manufacturing cost up.

There are a large number of different side-channel attacks. Generally, they fall into three categories:

  1. Attacks which are done by executing code on the same system upon which secrets are being processed. These attacks include timing attacks and cache attacks and can be done remotely and without physical access if code execution on the target device is possible. Mitigation involves secure software design. This is the easiest attack to pull off, and the easiest to mitigate.

  2. Attacks which require passive monitoring of the hardware. Differential power analysis and thermal imaging attacks fall into this category. It requires physical access to the target device and often very specialized equipment, but can be done even without code execution on the target.

  3. Fault attacks where errors are triggered in the device by doing things such as feeding an IC with the incorrect voltage or an unstable clock in a process called glitching. Even side-channel resistant software can be vulnerable to this. Sometimes this can even involve physically removing the surface of a chip and shooting it with a tightly-focused laser to trigger faults. The results of these faults can sometimes be detected through side-channel attacks. This often results in physical destruction of the device and, naturally, requires physical access.

Mitigating the first is usually possible to do cheaply in software. Mitigating the second may or may not be possible in software depending on the actual attack, and mitigating the third is rarely possible in software, although fault attack-resistant software can be designed with sufficient expertise.

Since these countermeasures are not widely known to the general public, is it true that people may not employ those measures. Is it also true that most consumer standard devices usually don't have these measures built into them?

It is often true, especially when the product does not use an established and popular library like OpenSSL which provide these mitigations and instead attempt to design it on their own. Those devices are often highly vulnerable to side-channel attacks, and abusing those weaknesses can be practical.

Unfortunately, the only cases where standard consumer devices do use such mitigations is with DRM in order to prevent their users from jailbreaking their own devices or running their own code on them. Companies which do that naturally care more about avoiding piracy (at the expense of restricting users' freedom) than about security against malicious attacks. This is because, in their threat model, the adversary is you, the device owner, not someone who is out to get your private information.

  • Thank you so much! Is there anyway that you could let me know your name so I can site you in my bibliography? Maybe through email or something if you don't mind? @forest – Stephanie Halim Nov 28 '18 at 14:08
  • @StephanieHalim I don't disclose my real name online, but you can cite Stack Exchange posts even if all you have is an alias and profile link and it will usually be a valid citation. – forest Nov 28 '18 at 14:11
  • By clicking on "edited X time ago", you can obtain a link to a specific revision of an answer that can be cited. "forest" is as good a name as any other. Mine is also a pseudonym (randomly generated), there are no reason that my more conventional pseudonym should be more easily cited than a lowercase name. – A. Hersean Nov 28 '18 at 14:17
  • @A.Hersean I edit my question gradually over a period of time (and am doing so now to include information on specific types of attacks), so the latest revision will always be the most comprehensive. – forest Nov 28 '18 at 14:23
  • @forest I agree with you, but in scientific papers you usually need to reference a specific version (dated) even though better references might appear afterwards. Depending on his needs, the OP might prefer (or not) a specific version. To always point to the latest version, the link "share" can be used instead, but it's easier to find, so I did not point it out in my previous comment. – A. Hersean Nov 28 '18 at 16:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.