Mercurial > dropbear

annotate notes/tech0002.txt @ 151:8fc624ea2521 libtomcrypt

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
Cleaning up various unused bits (des_*, rijndael, MDS for twofish)
author Matt Johnston <matt@ucc.asn.au>
date Mon, 20 Dec 2004 14:25:33 +0000
parents d7da3b1e1540
children
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
rev   line source
0
d7da3b1e1540 put back the 0.95 makefile which was inadvertently merged over
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
1 Tech Note 0002
d7da3b1e1540 put back the 0.95 makefile which was inadvertently merged over
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
2 How to avoid non-intrusive timing attacks with online computations
d7da3b1e1540 put back the 0.95 makefile which was inadvertently merged over
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
3 Tom St Denis
d7da3b1e1540 put back the 0.95 makefile which was inadvertently merged over
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
4
d7da3b1e1540 put back the 0.95 makefile which was inadvertently merged over
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
5 Introduction
d7da3b1e1540 put back the 0.95 makefile which was inadvertently merged over
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
6 ------------
d7da3b1e1540 put back the 0.95 makefile which was inadvertently merged over
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
7
d7da3b1e1540 put back the 0.95 makefile which was inadvertently merged over
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
8 A timing attack is when an attacker can observe a side channel of the device (in this case time). In this tech note
d7da3b1e1540 put back the 0.95 makefile which was inadvertently merged over
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
9 we consider only non-intrusive timing attacks with respect to online computations. That is an attacker can
d7da3b1e1540 put back the 0.95 makefile which was inadvertently merged over
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
10 determine when a computation (such as a public key encryption) begins and ends but cannot observe the device
d7da3b1e1540 put back the 0.95 makefile which was inadvertently merged over
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
11 directly. This is specifically important for applications which transmit data via a public network.
d7da3b1e1540 put back the 0.95 makefile which was inadvertently merged over
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
12
d7da3b1e1540 put back the 0.95 makefile which was inadvertently merged over
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
13 Consider a Diffie-Hellman encryption which requires the sender to make up a public key "y = g^x mod p". Libtomcrypt
d7da3b1e1540 put back the 0.95 makefile which was inadvertently merged over
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
14 uses the MPI bignum library to perform the operation. The time it takes to compute y is controlled by the number
d7da3b1e1540 put back the 0.95 makefile which was inadvertently merged over
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
15 of 1 bits in the exponent 'x'. To a large extent there will be the same number of squaring operations. "1" bits in
d7da3b1e1540 put back the 0.95 makefile which was inadvertently merged over
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
16 the exponent require the sender to perform a multiplication. This means to a certain extent an attacker can
d7da3b1e1540 put back the 0.95 makefile which was inadvertently merged over
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
17 determine not only the magnitude of 'x' but the number of one bits. With this information the attacker cannot directly
d7da3b1e1540 put back the 0.95 makefile which was inadvertently merged over
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
18 learn the key used. However, good cryptography mandates the close scrutiny of any practical side channel.
d7da3b1e1540 put back the 0.95 makefile which was inadvertently merged over
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
19
d7da3b1e1540 put back the 0.95 makefile which was inadvertently merged over
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
20 Similar logic applies to the other various routines. Fortunately for this case there is a simple solution. First,
d7da3b1e1540 put back the 0.95 makefile which was inadvertently merged over
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
21 determine the maximum time the particular operation can require. For instance, on an Athlon 1.53Ghz XP processor a
d7da3b1e1540 put back the 0.95 makefile which was inadvertently merged over
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
22 DH-768 encryption requires roughly 50 milliseconds. Take that time and round it up. Now place a delay after the call.
d7da3b1e1540 put back the 0.95 makefile which was inadvertently merged over
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
23
d7da3b1e1540 put back the 0.95 makefile which was inadvertently merged over
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
24 For example,
d7da3b1e1540 put back the 0.95 makefile which was inadvertently merged over
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
25
d7da3b1e1540 put back the 0.95 makefile which was inadvertently merged over
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
26 void demo(void) {
d7da3b1e1540 put back the 0.95 makefile which was inadvertently merged over
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
27 clock_t t1;
d7da3b1e1540 put back the 0.95 makefile which was inadvertently merged over
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
28
d7da3b1e1540 put back the 0.95 makefile which was inadvertently merged over
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
29 // get initial clock
d7da3b1e1540 put back the 0.95 makefile which was inadvertently merged over
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
30 t1 = clock();
d7da3b1e1540 put back the 0.95 makefile which was inadvertently merged over
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
31
d7da3b1e1540 put back the 0.95 makefile which was inadvertently merged over
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
32 // some PK function
d7da3b1e1540 put back the 0.95 makefile which was inadvertently merged over
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
33
d7da3b1e1540 put back the 0.95 makefile which was inadvertently merged over
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
34 // now delay
d7da3b1e1540 put back the 0.95 makefile which was inadvertently merged over
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
35 while (clock() < (t1 + 100));
d7da3b1e1540 put back the 0.95 makefile which was inadvertently merged over
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
36
d7da3b1e1540 put back the 0.95 makefile which was inadvertently merged over
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
37 // transmit data...
d7da3b1e1540 put back the 0.95 makefile which was inadvertently merged over
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
38
d7da3b1e1540 put back the 0.95 makefile which was inadvertently merged over
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
39 }
d7da3b1e1540 put back the 0.95 makefile which was inadvertently merged over
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
40
d7da3b1e1540 put back the 0.95 makefile which was inadvertently merged over
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
41 This code has the effect of taking at least 100 ms always. In effect someone analyzing the traffic will see that the
d7da3b1e1540 put back the 0.95 makefile which was inadvertently merged over
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
42 operations always take a fixed amount of time. Since no two platforms are the same this type of fix has not been
d7da3b1e1540 put back the 0.95 makefile which was inadvertently merged over
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
43 incorporated into libtomcrypt (nor is it desired for many platforms). This requires on the developers part to profile
d7da3b1e1540 put back the 0.95 makefile which was inadvertently merged over
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
44 the code to determine the delays required.
d7da3b1e1540 put back the 0.95 makefile which was inadvertently merged over
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
45
d7da3b1e1540 put back the 0.95 makefile which was inadvertently merged over
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
46 Note that this "quick" fix has no effect against an intrusive attacker. For example, power consumption will drop
d7da3b1e1540 put back the 0.95 makefile which was inadvertently merged over
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
47 significantly in the loop after the operation. However, this type of fix is more important to secure the user of the
d7da3b1e1540 put back the 0.95 makefile which was inadvertently merged over
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
48 application/device. For example, a user placing an order online won't try to cheat themselves by cracking open their
d7da3b1e1540 put back the 0.95 makefile which was inadvertently merged over
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
49 device and performing side-channel cryptanalysis. An attacker over a network might try to use the timing information
d7da3b1e1540 put back the 0.95 makefile which was inadvertently merged over
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
50 against the user.
d7da3b1e1540 put back the 0.95 makefile which was inadvertently merged over
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
51
d7da3b1e1540 put back the 0.95 makefile which was inadvertently merged over
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
52