5 ms·
So what hearing is: - AES is vulnerable to timing attacks by design unless the implementation is very careful. But even then no promise it is safe because of C
by feld 12y ago
So what hearing is:
- AES is vulnerable to timing attacks by design unless the implementation is very careful. But even then no promise it is safe because of CPU hardware nuances between models and architectures.
- Use AES-GCM if you must use AES.
- AES-GCM(?) is accelerated by the Intel AES extension and provides a constant-time implementation, but you have to trust Intel's hardware isn't backdoored.
- Don't use AES for network communications if you can avoid it.
Is this correct?
- bascule 12y agoAES-NI can be used to accelerate AES on Intel CPUs. CLMUL instructions (namely PCLMULQDQ) can be used to accelerate GCM. You need to use both in conjunction for a fast, constant-time AES implementation. However, the conclusion to draw is more general: any data dependent timings in any cipher implementation can be catastrophic.
- iacr262y2y2y 12y ago1 https://www.iacr.org/search/?q=AES+Cipher+Keys https://www.iacr.org/search/?q=AES+Cipher+Keys 2 prediction: 3 side-channel attack + boomerang attack 10 round >> AES-128 Broken 4 gap = goal(10 round) - present (7 round) = future (3 round) 5 gap/time = estimate at 1 year 6 software goal = http://hashcat.net/oclhashcat/ http://hashcat.net/oclhashcat/ 7 prediction method: 8 curl, elinks, word cluster, topic summaries 9 : 10 AES Cipher Keys Suitable for Efficient Side-Channel 11 Vulnerability Evaluation 12 Takaaki Mizuki, Yu-ichi Hayashi Tohoku University 13 Abstract 14 This paper investigates pairs of AES-128 cipher keys and 15 plaintexts which result in being “quiet” in the final round, 16 i.e., whose 128-bit State holds the same bit pattern 17 before and after Round 10. 18 HOLDS THE SAME BIT PATTERN BEFORE AND AFTER ROUND 10. 19 ...Because such quiet and noisy plaintexts make extreme actions 20 in the final round of the AES encryption, these AES-128 cipher keys 21 are quite useful for AES hardware designers to efficiently 22 evaluate the vulnerabilities of their products, 23 for instance, the performance of their side-channel attack 24 countermeasures. 25 Table 8: The Estimated SNR at various distances from the FPGA. 26 9 Conclusion 27 recent research has been adopting the idea that suitable plaintexts, 28 say those with rather small (but non-zero) Hamming distances 29 in the final round, are chosen for efficient side-channel attack evaluation. 30 there has not been any study that uses quiet plaintexts 31 (i.e., those with exactly-zero-Hamming distance) yet. 32 New Related-Key Boomerang Attacks on AES 33 Michael Gorski and Stefan Lucks, Bauhaus-University Weimar, Germany 34 Abstract. In this paper we present two new attacks on round reduced 35 versions of the AES. We present the first application of the related-key 36 boomerang attack on 7 and 9 rounds of AES-192. The 7-round attack 37 requires only 218 chosen plaintexts and ciphertexts and needs 38 267.5 encryptions. We extend our attack to nine rounds of AES-192. 39 This leaves to a data complexity of 267 chosen plaintexts and ciphertexts 40 using about 2143.33 encryptions to break 9 rounds of AES-192. 41 Conclusion 42 The AES remains still unbroken but we have shown that up to 43 7 rounds practical attacks are available yet. 44 7 ROUNDS PRACTICAL ATTACKS ARE AVAILABLE
- geofft 12y agoI think worrying about a backdoor is mis-aiming paranoia. If the hardware were backdoored, it could do malicious things to you whether or not you call PCLMULQDQ. What you should be worried about is something much more common: you have to trust that Intel's hardware is correctly implemented. Intel does a fantastic job at an extremely hard problem, but they still make the occasional mistake: http://www.anandtech.com/show/8376/intel-disables-tsx-instructions-erratum-found-in-haswell-haswelleep-broadwelly http://www.anandtech.com/show/8376/intel-disables-tsx-instru... The AES-NI and CLMUL instructions promise two things: first, that they'll do the math correctly, and second, that they'll do it in constant time with respect to secret data. I don't think anything else nontrivial in the architecture makes that second promise. (On a minor technical point: AES itself is constant-time if you have AES-NI, which is moderately more common than CLMUL. It's just that, cryptographically, almost all new users of AES today should be using AES-GCM, and that involves a not-easily-constant-time operation separate from the AES block cipher itself.)
- zimmerfrei 12y ago>> - Use AES-GCM if you must use AES Without CLMUL instructions, GCM is either very slow or potentially sensitive to cache-based side-channel attacks (regardless of AES being the underlying cipher). The EAX mode of operation is more secure - though not very popular for some reasons and not part of any TLS cipher suite.
- stouset 12y agoEAX is protected by patents.
- zimmerfrei 12y agoCould you provide a reference?
- tptacek 12y agoGiven Rogaway's recent patent grants, OCB would be a more straightforward improvement over GCM.
- tedunangst 12y agoDoes anything use OCB? It seems GCM "won". The patents may have killed it. Even "free for open source" can be troublesome if you're worried about putting free software into an appliance and getting trapped. Easier to avoid patented algos entirely.
- AlyssaRowan 12y agoRogaway's patent grants are now very liberal: they cover all open source and everything non-military. It passed through CFRG, too, and is documented in an RFC: https://tools.ietf.org/html/rfc7253 https://tools.ietf.org/html/rfc7253 But yes, definitely the fact that there were patent grants hurt it a lot in adoption before; even when (as in WiFi) it was one of the contenders, CCM is more common. A few things do use it: off the top of my head, I think Mumble does, although I think that's an earlier variant (OCB2, perhaps, rather than OCB3 as documented in the RFC?). I'm also looking forward to the results of the CAESAR authenticated-encryption competition - http://competitions.cr.yp.to/caesar.html http://competitions.cr.yp.to/caesar.html - there's a lot of competition, and quite a few entries fell and have been withdrawn. The current version of OCB is among the current list of contenders, among several other interesting candidates.