Re: Successful remote AES key extraction

From: D. J. Bernstein (djb_at_cr.yp.to)
Date: 04/20/05 

Date: Tue, 19 Apr 2005 23:11:51 +0000 (UTC)

Tom St Denis wrote:
> The AES specification specifies only the algorithm not it's implementation.

The AES designers and official evaluators

   * considered timing attacks in detail,
   * claimed that table lookup was ``not vulnerable to timing attacks,''
   * claimed that Rijndael gained a ``major speed advantage over its
     competitors'' for software protected against timing attacks,
   * made the same comment in its summaries of the finalists, and
   * made the same comment in its paragraph explaining the selection of
     Rijndael.

The problem is that, when they stated ``Table lookup: not vulnerable to
timing attacks,'' they were simply wrong. Table lookup _is_ vulnerable
to timing attacks.

All of this is in the published record of the AES selection process. See
Section 7 of my paper for citations.

---D. J. Bernstein, Associate Professor, Department of Mathematics,
Statistics, and Computer Science, University of Illinois at Chicago

Relevant Pages

  • Re: Successful remote AES key extraction
    ... that run trusted code and contain encapsulated keys and ciphers. ... RSA blinding to prevent timing attacks is normal and expected practice ... A lot of these modules contain DES hardware engines but not AES. ...
    (sci.crypt)
  • Re: Whats wrong with AES?
    ... karl malbrain wrote: ... implementations of AES? ... degree of immunity from timing attacks. ... compilers that generate P-code also produce executables that ...
    (sci.crypt)
  • Re: Time attack resources ?
    ... (Timing attacks in specific) ... algorithms that use SBox, like AES etc) ... describes an attack similar to mine but applied to AES instead of RSA: ...
    (sci.crypt)
  • Re: Dont use S-boxes!
    ... > The only real world setting where timing attacks matter is against an ... > embedded SYSTEM, like the hardware cards used for electronic banking. ... >>The code in the paper demonstrates that there can be a dependency of AES ... Next generation smartcards could well have cache sizes in ranges of a ...
    (sci.crypt)
  • Re: AES Galois Field Inverse
    ... A lookup table will be quicker and more universal than anything else I can ... to test a wide range of potential AES optimisations. ...
    (sci.crypt)