3 ms·
Is there any software-base implementation of AES that is NOT vulnerable to timing attacks and other side channel weakness and with reasonable performance (to th
by riobard 6y ago
Is there any software-base implementation of AES that is NOT vulnerable to timing attacks and other side channel weakness and with reasonable performance (to the limit of the hardware)?
- arcticbull 6y agoI was under the impression there were, but I'm no expert. [1] [1] https://www.iacr.org/archive/ches2009/57470001/57470001.pdf https://www.iacr.org/archive/ches2009/57470001/57470001.pdf
- JoachimSchipper 6y agoYes, that's the generic solution. They claim ~7 cycles per byte for 4096-byte blocks on the newest CPU tested, but I don't know what the performance would be on CPUs from 2020. (For context, per https://eprint.iacr.org/2018/392 https://eprint.iacr.org/2018/392, AES-NI is more than ten times faster.) Of course, AES-NI is generally preferable if you have it; and people use ChaCha on mobile platforms that don't have AES-NI but do have NEON (or another SIMD).
- bccdee 6y agoYes, but you have to use bitslicing for the s-boxes.