3 ms·

Using the AES-NI instructions completely gets rid of the attack on AES, and hopefully future ciphers will be designed from the start for side channel resistance

• p4bl0 13y ago
  > Using the AES-NI instructions completely gets rid of the attack on AES. I would be very, very careful before saying that. Actually I wouldn't even say it. Hardware implementation are also subject to side-channels, even when they include countermeasures. Leakage models we have for hardware are not accurate enough, and maybe they can't be. Take for instance with the power consumption side-channel: not every bit in a register leak the same (when being set or reset, they do not consume the same amount of energy / emit the same amount of EM radiation), and the actual leak depends on so many thing that the only way to know it is to measure it in the precise environment of the threat on the actual hardware that may be subject to attack. Actual hardware behavior is so difficult to predict, and side-channel attacks manage to exploit any bias, leak, glitch, anything. Plus, there is still the possibility of fault injection attacks…
• pedrocr 13y ago
  You're still hoping for no bugs and only considering the case of crypto. Maybe there are other interesting secrets recoverable with techniques like these from software written without such cares. Edit: I wonder if similar timing attacks can be used against the VMs of scripting languages to recover code. It would be a neat hack.