4 ms·
Fast table based software AES implementations leak bits of the secret key in array offsets, so anything that can use the cache on the chip can get the key. A so
by wolf550e 7y ago
Fast table based software AES implementations leak bits of the secret key in array offsets, so anything that can use the cache on the chip can get the key. A software implementation of AES that is secure against side channel attacks by using bitslicing is slow, you would be better off using chacha20-poly1305.
- fulafel 7y agoSo you're saying OpenSSL might still be using side channel vulnerable AES code, all these years after there was a big row about it? This ARMv8 impl according to comments is constant time: https://github.com/openssl/openssl/blob/master/crypto/aes/asm/vpaes-armv8.pl https://github.com/openssl/openssl/blob/master/crypto/aes/as... There are also other ARM AES implementations in the tree: https://github.com/openssl/openssl/tree/master/crypto/aes/asm https://github.com/openssl/openssl/tree/master/crypto/aes/as... AFAICT one is for the hardware AES instructions, and one is a bitsliced (so constant time) impl for 32-bit ARMv7, and one is for low end ARMv4. The latter sounds like it might still be vulnerable to timing sidechannel attacks but no idea if it is still used by default in any configuration...
- wolf550e 7y agoI don't know about openssl's status on old / weak platforms. People who need AES without hardware AES instructions should be using BearSSL code or the rust code that has been reviewed by the author of BearSSL (see e.g. https://github.com/RustCrypto/block-ciphers/issues/65 https://github.com/RustCrypto/block-ciphers/issues/65).