Re: [Cfrg] Upcoming competition deadlines

[Hanno Böck <[e-mail]>]

On Wed, 5 Mar 2014 18:10:06 -0800
Watson Ladd <[e-mail]> wrote:

> I think it's clear that we need a side-channels draft: since people
> seem to vehemently disagree about ladd-safecurves, and there are some
> open technical questions about what formats are good, I'm going to
> redirect my efforts to getting the side-channels draft further along.
> Comments on what would make it useful/scarier would be greatly
> appreciated.

Just some quick thoughts on that: I think this is remarkably
challenging. Because you're faced with a pretty tough question: What
exactly is a "side channel"?

We can probably come up with a formal definition of a timing side
channel easily. But "side channels" in general are an almost infinite
amunt of things. You could probably sum them up as "every information
about keys and encrypted messages that leaves a cryptosystem through
any kind of channel, including physics".

It's probably just plain impossible to build any kind of system that
does calculations without affecting its surrounding physics based on
the content of the calculation. That said: We probably have to face the
fact that a side channel-free system is impossible.

So any kind of side channel protection can only work with some kind of
heuristics. We can lower the information impact on the outside world
(this is what RSA blinding does for example).

-- 
Hanno Böck
http://hboeck.de/

mail/jabber: [e-mail]
GPG: BBB51E42