Re: [Cfrg] Mishandling twist attacks

["Lochter, Manfred" <[e-mail]>]

_

>
> There's a long tradition of blaming the implementor for the resulting
> security failures: it's the implementor's fault for not writing
> constant-time code, for not checking for exceptional cases, etc.
>
> However, we've known for many years how to _change the crypto_ to avoid
> all of these implementation pitfalls. Specifically, we
>
>    
>
>    * always set the top bit of scalars so that an input-length-agnostic
>      variant of the Montgomery ladder doesn't create a timing leak.
>

On the other hand this countermeasure is quite dangerous, when applied during 
signature generation. It may leak parts of the ephemeral keys. Which in turn 
allows lattice attacks. (The most dangerous situation being SW which is used 
in an protected environment, where only timing attacks are seen as a 
danger. )

Manfred


-- 
Lochter, Manfred
--------------------------------------------
Bundesamt für Sicherheit in der Informationstechnik (BSI)
Referat K21
Godesberger Allee 185 -189
53175 Bonn

Postfach 20 03 63
53133 Bonn

Telefon: [phone] 5643
Telefax: [phone] 5643
E-Mail: [e-mail]
Internet:
www.bsi.bund.de
www.bsi-fuer-buerger.de