3 ms·
I think this is the paper you're referring to: http://eprint.iacr.org/2013/448.pdf http://eprint.iacr.org/2013/448.pdf The only reason they were able to recove
by sillysaurus2 13y ago
I think this is the paper you're referring to: http://eprint.iacr.org/2013/448.pdf http://eprint.iacr.org/2013/448.pdf
The only reason they were able to recover the key in a single run is because GPG uses branching in its inner loop, making it trivial to determine the difference in timing between 1 and 0 bits of the key. AES requires no such branching. Attacking AES requires that the attacker try to predict the key, then calculate how long encryption would take if the attacker's guess was correct, then compare that guess to how long it actually took. This means it's not possible to recover the AES key in a single run unless the attacker happened to guess it correctly the first time (which is effectively impossible).
In other words, the paper you cited apparently doesn't build off of Osvik & Tromer at all, except in the sense that they're both cache timing attacks. The paper uses a completely different technique than Osvik & Tromer.
So how is it safe to reuse your AES key? I'm just trying to understand. Since the attacker needs multiple runs to attack AES, then wouldn't the logical defense be to rekey after every encryption?
It seems like you've been saying "it's impossible to defend against a side channel attack." But that doesn't seem to be true in the case of AES, as long as you don't reuse your key. What am I missing?
- tptacek 13y agoNo, that's not what I'm saying. I'm saying that the solution to side channel attacks is to eliminate the side channel, not to redesign the cryptosystem around it. I keep telling you this: you can reuse AES keys. Reusing an AES key does not in any intrinsic way reduce the security of AES (at least, not unless you encrypt a truly staggering amount of data with it). However: you should not be working with encryption at this level of detail anyways. Sillysaurus 2, please go download Nacl and play with it. You'll be using 2012 crypto instead of debating implementation flaws in old crypto.
- sillysaurus2 13y agoOkay, I was finally able to find a direct answer to my question by studying NaCl. http://cryptojedi.org/peter/data/tenerife-20130121.pdf http://cryptojedi.org/peter/data/tenerife-20130121.pdf "NaCl systematically avoids all loads from addresses that depend on secret data" "NaCl systematically avoids all branch conditions that depend on secret data" So NaCl is an implementation of AES encryption that prevents cache timing attacks. Since there are no other reasonable side channel attacks on AES, the AES key remains secure. Therefore reusing your AES key is ok provided you're using NaCl. (So you should probably be telling people they need to be using NaCl, not merely AES.) Thank you for the answers. Also, thanks for pointing me at NaCl. That's the most exciting crypto slide deck that's ever been written!