IETF Logo Mail Archive

Re: [Cfrg] Primes vs. hardware side channels

David Leon Gil <coruus@gmail.com> Fri, 17 October 2014 01:25 UTC

Return-Path: <coruus@gmail.com>
X-Original-To: cfrg@ietfa.amsl.com
Delivered-To: cfrg@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5E2C61A8789 for <cfrg@ietfa.amsl.com>; Thu, 16 Oct 2014 18:25:54 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2
X-Spam-Level:
X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, SPF_PASS=-0.001] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id rPfUtgFrYTeJ for <cfrg@ietfa.amsl.com>; Thu, 16 Oct 2014 18:25:52 -0700 (PDT)
Received: from mail-lb0-x22d.google.com (mail-lb0-x22d.google.com [IPv6:2a00:1450:4010:c04::22d]) (using TLSv1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7D9441A1BA4 for <cfrg@irtf.org>; Thu, 16 Oct 2014 18:25:52 -0700 (PDT)
Received: by mail-lb0-f173.google.com with SMTP id 10so3796326lbg.18 for <cfrg@irtf.org>; Thu, 16 Oct 2014 18:25:50 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :content-type; bh=pgvPSYlhvJqGYBK7KYU4+wF6Me6iGSsCn8uBzY/ndFE=; b=iNRBPHdQxi63LNW51dqn1NV55Gc3gFq50LvQzwVA1o0/QvEnNPiBIhzDZBvMIJ7Nhr 75ujOND/rUhOkY2f7GjqWk5DJvc81imVCrcvo2VEM/ayuE1Lv577M6NcHfHt54a2vPK4 3cIIT/B15n6Bxh6gcqK5B3PHX4+XIxeX86Kf/MGe1JAzH1ftDTmd7xVgaw66AdGD2x+6 4B8T1IK2Ok+4YvuQkQbOsgQ1KmCw2L0H4t8ia9cpS/pLJdVD9LuxWOOhhlqeDuolzQpC YMackAJ3yTIzX5onE6hs89CwQGN1ZItKTDsXW3CMadasrISTedKhpBuJTGWkDI5JEynY ukhw==
X-Received: by 10.152.25.130 with SMTP id c2mr5317559lag.80.1413509150839; Thu, 16 Oct 2014 18:25:50 -0700 (PDT)
MIME-Version: 1.0
Received: by 10.25.218.145 with HTTP; Thu, 16 Oct 2014 18:25:30 -0700 (PDT)
In-Reply-To: <20141017005511.14016.qmail@cr.yp.to>
References: <201410081357.03062.manfred.lochter@bsi.bund.de> <20141017005511.14016.qmail@cr.yp.to>
From: David Leon Gil <coruus@gmail.com>
Date: Thu, 16 Oct 2014 21:25:30 -0400
Message-ID: <CAA7UWsXps+kwmdBkkTaSXyN71w7sc9LaCvtEP1sRsQxJzJtOEg@mail.gmail.com>
To: "cfrg@irtf.org" <cfrg@irtf.org>, "D. J. Bernstein" <djb@cr.yp.to>
Content-Type: text/plain; charset="UTF-8"
Archived-At: http://mailarchive.ietf.org/arch/msg/cfrg/S_5SfmzCTCTyA8xIaFSnHUMZWqM
Subject: Re: [Cfrg] Primes vs. hardware side channels
X-BeenThere: cfrg@irtf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: Crypto Forum Research Group <cfrg.irtf.org>
List-Unsubscribe: <http://www.irtf.org/mailman/options/cfrg>, <mailto:cfrg-request@irtf.org?subject=unsubscribe>
List-Archive: <http://www.irtf.org/mail-archive/web/cfrg/>
List-Post: <mailto:cfrg@irtf.org>
List-Help: <mailto:cfrg-request@irtf.org?subject=help>
List-Subscribe: <http://www.irtf.org/mailman/listinfo/cfrg>, <mailto:cfrg-request@irtf.org?subject=subscribe>
X-List-Received-Date: Fri, 17 Oct 2014 01:25:54 -0000

On Thu, Oct 16, 2014 at 8:55 PM, D. J. Bernstein <djb@cr.yp.to> wrote:
> In the case of Brainpool's 256-bit curve, the defense under discussion
> consists of obscuring the bits of a 256-bit scalar s by adding a small
> multiple of the 256-bit group order to s, typically a 32-bit multiple.
> This seems safe if the bits are further obscured by a considerable level
> of physical noise. However, for plausibly smaller noise levels this is
> breakable, as illustrated by the recent paper by Schindler and Wiemers.

For folks less familiar with this issue, page 85 et seq. of (the
slides for) Marc Joye's FDTC 2013 keynote present a very readable
explanation of why additive blinding, as described above, doesn't
work:

http://conferenze.dei.polimi.it/FDTC13/shared/FDTC-2013-keynote-2.pdf

v2.23.0 | Report a Bug | By Email