4 ms·
Seems like the simplest way to mitigate is to randomly throw some junk at the problem. Some random cypto code, some random no-purpose cryptographic calculation
by sandworm101 4y ago
Seems like the simplest way to mitigate is to randomly throw some junk at the problem. Some random cypto code, some random no-purpose cryptographic calculations, should prevent any listener from gaining any useful information. It shouldn't take much, a single-digit percentage increase during cypto functions would be enough imho.
- snowwrestler 4y agoEssentially, a computational time salt.
- sandworm101 4y agoThere are a dozen names for it. In the intelligence world, if you know that the enemy is listening on an unencrypted communications pipe, but you cannot afford to stop using that pipe, you throw random junk down the pipe until they cannot tell real from fake.
- IncRnd 4y agoExcellent point. In this case, the name used here is masking, referring to what is called data masking, and the reference was to adding noise. There are other operations(as you point out) that could also be used (substitution, shuffling, etc.).
- colinsane 4y agowell, yes. if you’re an NSA-level actor your AES implementation hasn’t been `AES_encode(key, input)`, but `AES_encode(key, input, random)`. you then XOR the randomness into the input, do all your (modified) AES operations, and then XOR the randomness out [1]. the modified AES operations take about double the area/power because your “input” is effectively twice as long as it used to be, but there’s now next to zero correlation between input/key and power use. like most things, i expect the reason they’re not adopted for consumer devices is because they use notably more power/area/are slower. [1] enter "Provably Secure Masking of AES" into scihub and you'll find a useful paper by Blömer, Merchan and Krummel from 2004.