4 ms·

Are their any small form factor smart card like devices that are immune from side channel attacks like these? It seems like using constant power without much ha

by diafygi 11y ago

Are their any small form factor smart card like devices that are immune from side channel attacks like these? It seems like using constant power without much hardware to buffer stuff out is very difficult.

blazespin 11y ago
nothing is immune. Any crypto is breakable by someone who is sufficiently smarter than the person who invented the crypto. This is why crypto security is so hard. There is always someone sufficiently smarter. In general the strongest security is always physical security (attack dogs, machine guns, etc). The problem with that, of course, is that someone more vicious might come along. Also, physical security is somewhat vulnerable to physical degradation (earthquakes, fires, etc) Also, physical security is pretty awkward to implement and maintain, plus it really complicates access and transfer of secured materials.
tptacek 11y ago
Yes; this was Cryptography Research's main line of business for a long time. Rambus owns them now. http://www.rambus.com/security/dpa-countermeasures/ http://www.rambus.com/security/dpa-countermeasures/ The solutions for many (most?) of these problems are patented.
- nickpsecurity 11y ago
  "The solutions for many (most?) of these problems are patented." Very aggravating that this is still true.
jeff_marshall 11y ago
Back when I was doing crypto at the algorithm implementation level, I found the proceedings of the CHES[1] conference had a lot of good information on where the public state of the art was regarding side channel attack and defence. Keep in mind that side channels are very much a moving target - an implementation that isn't vulnerable to a known attack today could fall to an attack discovered tomorrow. Unless you take extradinary measures to prevent physical measurements of your implementation and detect and respond to physical tamper events, some kind of attack (practical or not) will probably turn up during the useful life of an implementation, in my experience. With small and/or low-cost devices, such physical countermeasures are usually impractical, so you have to take extra care on the HW/SW algorithm implementation side to avoid vulnerabilities. [1] https://www.cryptoexperts.com/ches2015/index.html https://www.cryptoexperts.com/ches2015/index.html
TD-Linux 11y ago
You need both constant power hardware and software to be immune (and to related timing attacks). The libsecp256k1 library for example is designed to be timing attack resistant, but I'm still working on verifying how power sidechannel resistant it is. Using an internal power source, like a primary lithium cell, is one way to circumvent the power sidechannel. But power sidechannels can also easily become RF sidechannels, so it's still good to minimize them.

by diafygi 11y ago

blazespin 11y ago

nothing is immune. Any crypto is breakable by someone who is sufficiently smarter than the person who invented the crypto. This is why crypto security is so hard. There is always someone sufficiently smarter. In general the strongest security is always physical security (attack dogs, machine guns, etc). The problem with that, of course, is that someone more vicious might come along. Also, physical security is somewhat vulnerable to physical degradation (earthquakes, fires, etc) Also, physical security is pretty awkward to implement and maintain, plus it really complicates access and transfer of secured materials.

tptacek 11y ago

Yes; this was Cryptography Research's main line of business for a long time. Rambus owns them now. http://www.rambus.com/security/dpa-countermeasures/ http://www.rambus.com/security/dpa-countermeasures/ The solutions for many (most?) of these problems are patented.

nickpsecurity 11y ago
"The solutions for many (most?) of these problems are patented." Very aggravating that this is still true.

jeff_marshall 11y ago

Back when I was doing crypto at the algorithm implementation level, I found the proceedings of the CHES[1] conference had a lot of good information on where the public state of the art was regarding side channel attack and defence. Keep in mind that side channels are very much a moving target - an implementation that isn't vulnerable to a known attack today could fall to an attack discovered tomorrow. Unless you take extradinary measures to prevent physical measurements of your implementation and detect and respond to physical tamper events, some kind of attack (practical or not) will probably turn up during the useful life of an implementation, in my experience. With small and/or low-cost devices, such physical countermeasures are usually impractical, so you have to take extra care on the HW/SW algorithm implementation side to avoid vulnerabilities. [1] https://www.cryptoexperts.com/ches2015/index.html https://www.cryptoexperts.com/ches2015/index.html

TD-Linux 11y ago

You need both constant power hardware and software to be immune (and to related timing attacks). The libsecp256k1 library for example is designed to be timing attack resistant, but I'm still working on verifying how power sidechannel resistant it is. Using an internal power source, like a primary lithium cell, is one way to circumvent the power sidechannel. But power sidechannels can also easily become RF sidechannels, so it's still good to minimize them.