6 ms·
> For encryption operations these aren't catastrophic things to leak — the final block of output is ciphertext, and the final AES round key, while theoretically
by pbsd 12y ago
> For encryption operations these aren't catastrophic things to leak — the final block of output is ciphertext, and the final AES round key, while theoretically dangerous, is not enough on its own to permit an attack on AES
This is incorrect. The AES key schedule is bijective, which makes recovering the last round key as dangerous as recovering the first.
- cperciva 12y agoOops, quite right. I was looking at the "mix and xor" and my brain jumped to "oh, this is the standard hash idiom" and I completely missed the fact that the word being xored is not the word being mixed...
- tptacek 12y agoHow hard is that attack to code? I have a hard time imagining a case where a target leaks just a subkey, so this is one of those things I knew "about" but not "how".
- cperciva 12y agoDead simple. 2nd year undergraduate programming assignment.
- tptacek 12y agoIs it perhaps so simple that... Colin Percival could effectively describe how to do it in an HN comment, perhaps even challenging someone like Thomas Ptacek to code it up and publish it instead of just yakking on HN like he always does I hate him so much?
- cperciva 12y agoEach word in the 4-word AES round keys is computed as w[i] = Mangle(w[i - 1]) xor w[i - 4], where Mangle(x) = Subword(Rotword(x)) xor Rcon for i%4=0 and Mangle(x) = x otherwise. Just turn that around and you get w[i - 4] = w[i] xor Mangle(w[i - 1]). Now start with i = 43 (i.e., w[i] is the last word of the last round key) and count backwards, filling in words of the round keys until you get to w[0]. Then w[0..3] is the AES key.
- pbsd 12y agoIt's pretty straightforward to just iterate the key schedule backwards using the inverse S-box and a few xors; no need for any fancy stuff.
- p4bl0 12y agocperciva already answered, so I'll just add that most side-channel attacks (at least those using power analysis) on AES typically focus on the last round.
- tptacek 12y agoA-ha. That makes a lot of sense. Thank you!