> I remember a cryptography project at uni where we had to implement RSA - that is everything including the large integer support. Besides my day job, I'm stil

> I remember a cryptography project at uni where we had to implement RSA - that is everything including the large integer support. Besides my day job, I'm still kinda-sorta fumbling around doing CS masters courses and ended up doing a similar project last semester. The project I was doing was actually about power analysis side channel attacks (in a group of CS students, I was the only one who would take a project where you had to touch actual hardware), so the end game was getting my make-shift 128 bit RSA to run on an AVR. The big-integer-code actually turned out to be the nastiest part of the whole thing. My initial naive implementation took several minutes on my desktop PC. A few long nights later, it ran in 30-ish seconds or so on the AVR, using the internal 1 MHz RC oscillator[1][2]. I initially expected the static power analysis to be a PITA, but finding the square-multiply-loop in the trace and triggering on it turned out to be surprisingly simple[3][4]. It was IMO kinda scary how easy that turned out to be. So yes, even if you get the obvious cryptographic foot guns right (as opposed to the additional non-obvious foot guns), the possibility for additional side-channel attacks are also plenty. [1] https://i.imgur.com/zk7IXKd.jpeg https://i.imgur.com/zk7IXKd.jpeg [2] https://i.imgur.com/Ddu2sgo.jpg https://i.imgur.com/Ddu2sgo.jpg [3] https://i.imgur.com/D1cMhzn.png https://i.imgur.com/D1cMhzn.png [4] https://i.imgur.com/rNnLJan.png https://i.imgur.com/rNnLJan.png