3 ms·
Both AES and GHASH have their own timing side-channel issues. If you need to encrypt something, I recommend NaCl: http://nacl.cr.yp.to/ http://nacl.cr.yp.to/
by agl 14y ago
Both AES and GHASH have their own timing side-channel issues.
If you need to encrypt something, I recommend NaCl: http://nacl.cr.yp.to/ http://nacl.cr.yp.to/
- ctz 14y agoAre you saying that there is an equivalent attack for the AES-GCM TLS 1.2 ciphersuites? If so, paper please :)
- JoachimSchipper 14y agoThere have been cache-based timing attacks on AES; these are hard to stop completely. To the best of my knowledge, this is not a knock on GCM specifically; but I'd be happy to learn more.
- moonboots 14y agoBesides the difficulties of patching openssl and nss, what are other technical and political challenges preventing the adoption of djb's crypto primivatives in tls?
- JoachimSchipper 14y agoThey have not been reviewed to anywhere near the extent that AES and co. have been. So few people use them, which makes them less attractive targets for cryptanalysis, and so on. Also, I'm under the impression that NaCl achieves impressive speeds, but at the cost of using implementations tuned to a specific CPU. This makes the amount of code that has to be reviewed considerably larger.