4 ms·

I recently learned about side channel attacks on ChaCha20, and all other ARX ciphers. ChaCha20 and its kin are of course resistant to timing side channels by t

I recently learned about side channel attacks on ChaCha20, and all other ARX ciphers. ChaCha20 and its kin are of course resistant to timing side channels by their nature. Without thinking about it I had assumed they would resist other forms of side channel too (cache, power, EM, etc). ChaCha20 performs the exact same operations every time, regardless of its inputs. And the mixing should eventually lead to an even mixture of flip-flopping towards the middle of the cipher. So, how could it be exposed to any side channel? Well apparently it's still weak to power (and EM by proxy) analysis: https://eprint.iacr.org/2017/1021 https://eprint.iacr.org/2017/1021 I haven't had the time or inclination to study the paper in depth. But if understood it correctly, the very act of accessing memory exposes the data being accessed. Even if the power difference between accessing, say 0xaf and 0x30 is so infinitesimal, it's apparently enough to correlate with power analysis and crack keys. Quite amazing.

colmmacc 8y ago
It can be easy to forget because we all sort of mentally accept it, but ChaCha20 is length preserving, and so is trivially vulnerable to by far the simplest network side channel: size based traffic analysis. AES-GCM is too, in the same way, but AES-CBC was actually a /little/ better because it's padded to the nearest block which provides a small measure of length hiding. Imagine you're a state authority who wants to know who is looking at what on the internet. It's pretty easy to fingerprint websites and webpages by size; the pattern of HTML, images, video, and CSS, is highly unique. There are published papers doing this against Google Maps tiles, and Netflix movies. It's very very practical. It's utterly feasible for authorities to build these fingerprint DBs, and to fingerprint any traffic they have visibility of.

colmmacc 8y ago

It can be easy to forget because we all sort of mentally accept it, but ChaCha20 is length preserving, and so is trivially vulnerable to by far the simplest network side channel: size based traffic analysis. AES-GCM is too, in the same way, but AES-CBC was actually a /little/ better because it's padded to the nearest block which provides a small measure of length hiding. Imagine you're a state authority who wants to know who is looking at what on the internet. It's pretty easy to fingerprint websites and webpages by size; the pattern of HTML, images, video, and CSS, is highly unique. There are published papers doing this against Google Maps tiles, and Netflix movies. It's very very practical. It's utterly feasible for authorities to build these fingerprint DBs, and to fingerprint any traffic they have visibility of.