Re: [Cfrg] Side channel attack and Edwards curves...

[Phillip Hallam-Baker <[e-mail]>]

On Wed, Jul 5, 2017 at 6:01 PM, Tony Arcieri <[e-mail]> wrote:

> On Wed, Jul 5, 2017 at 11:38 AM, Phillip Hallam-Baker <
> [e-mail]> wrote:
>
>> Just another side channel attack and not something that bothers me
>> writing reference code. But have we maybe put our eggs in the Montgomery
>> ladder basket when maybe we should have gone for 'randomly split the
>> private key into two parts, perform two separate multiplications with each
>> part and add the result'.
>>
>
> I'm not sure why you're talking about Montgomery vs Edwards here. This is
> a Flush+Reload attack similar to:
>

​You can blind in either. But if you are going to blind then a lot of the
advantages of Montgomery start to collapse. because you have to do that add
stage.



> - "Just A Little Bit": https://eprint.iacr.org/2014/161.pdf
> - "Just A Little Bit More": https://eprint.iacr.org/2014/434.pdf
> - Cachebleed: https://eprint.iacr.org/2016/224.pdf
>
> If there was a conclusion I drew from these attacks, it's the need to
> include random values, as the security proofs say we should do.
>
> I will note that BoringSSL was not vulnerable to Cachebleed because they
> continued to use random blinding in addition to Intel's allegedly "constant
> time" RSA code. Though many are quick to dismiss it, random blinding seems
> to provide defenses against a multitude of attacks, not just cache timing
> but DPA as well.
>
> --
> Tony Arcieri
>