4 ms·
> A deterministic AES mis-computation, which was “selfinverting”: encrypting and decrypting on the same core yielded the identity function, but decryption elsew
by sfvisser 5y ago
> A deterministic AES mis-computation, which was “selfinverting”: encrypting and decrypting on the same core
yielded the identity function, but decryption elsewhere
yielded gibberish.
Incredible
- formerly_proven 5y agoSounds like a corrupted S-box or something like that in the hardware implementing AES-NI
- twic 5y agoDepends on the mode. AES-CTR encrypts an increasing counter to make a keystream, then xors that with the plaintext to make the ciphertext, or with the ciphertext to make the plaintext. Any consistent error in encryption will lead to a consistently wrong keystream, which will round-trip successfully. It's possible other modes have this property because of the structure of the cipher itself, but that's way out of my league.
- muricula 5y agoThe intel AES instructions work at a block level. You build the mode on top of the block level primitives intel gives you. https://en.wikipedia.org/wiki/AES_instruction_set https://en.wikipedia.org/wiki/AES_instruction_set
- buildbot 5y agoThis specifically stood out to me - it implies it is possible to hide weakened/bad crypto via manufacturing bugs
- muricula 5y agoI'm not sure about that. I think it's just that the AES hardware was busted somehow and didn't actually perform the AES algorithm correctly. The intel AES hardware just deterministically performs the algorithm, so Intel can't just weaken the algorithm somehow, at least if you're not worrying about local side channels.