Re: [Cfrg] Side channel attack and Edwards curves...

[Tony Arcieri <[e-mail]>]

On Wed, Jul 5, 2017 at 11:38 AM, Phillip Hallam-Baker <[e-mail]
> wrote:

> Just another side channel attack and not something that bothers me writing
> reference code. But have we maybe put our eggs in the Montgomery ladder
> basket when maybe we should have gone for 'randomly split the private key
> into two parts, perform two separate multiplications with each part and add
> the result'.
>

I'm not sure why you're talking about Montgomery vs Edwards here. This is a
Flush+Reload attack similar to:

- "Just A Little Bit": https://eprint.iacr.org/2014/161.pdf
- "Just A Little Bit More": https://eprint.iacr.org/2014/434.pdf
- Cachebleed: https://eprint.iacr.org/2016/224.pdf

If there was a conclusion I drew from these attacks, it's the need to
include random values, as the security proofs say we should do.

I will note that BoringSSL was not vulnerable to Cachebleed because they
continued to use random blinding in addition to Intel's allegedly "constant
time" RSA code. Though many are quick to dismiss it, random blinding seems
to provide defenses against a multitude of attacks, not just cache timing
but DPA as well.

-- 
Tony Arcieri