These sorts of side channel vulnerabilities aren't some sort of new revelation-- the notion dates at least back to 2002 (per the authors' cited references). F

These sorts of side channel vulnerabilities aren't some sort of new revelation-- the notion dates at least back to 2002 (per the authors' cited references). For example, one of the design goals of DJB's NaCl [1] is to mitigate side-channel vulnerabilities, specifically calling out data flow from secrets to load addresses (which has been used to break AES via a timing attack) and data flow from secrets to branch conditions (which is the sort of thing that's happening here-- where you can see secret-dependent patterns in the number and timing of operations in ECDSA computations) [2]. What's novel here is just how cheaply they're able to carry out these side-channel attacks. [1] https://nacl.cr.yp.to/ https://nacl.cr.yp.to/ [2] http://cr.yp.to/highspeed/coolnacl-20120725.pdf http://cr.yp.to/highspeed/coolnacl-20120725.pdf -- see section 3, Core security features and their impact