full-disclosure - Timing attack against RSA private keys.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <54407615209.20030326165313@dice.ucl.ac.be>
From: fkoeune at dice.ucl.ac.be (Francois Koeune)
Subject: Timing attack against RSA private keys.

I read your post describing Brumley-Boneh's timing attack with much
interest.

However, I feel a bit sceptical about the second countermeasure you
suggest, namely to use larger RSA keys. I am not familiar with details
of Brumley-Boneh's attack, but usually timing attacks' complexity does
not increase dramatically with key size. For example, the timing
attack against RSA without CRT needed 1000-2000 messages to break a
128-bit key, and 5000-10000 messages to break a 512-bit key [1]. If I
remember correctly, Schindler's attack against RSA with CRT (which is
the basis of Brumley-Boneh's attack) evolves similarly with key sizes.

I think it might be risky to conclude that the attack is not practical
against larger keys, simply because the authors present their attack
in a 1024-bit context.

[1] http://www.dice.ucl.ac.be/~fkoeune/thesis.ps.gz

--
 Francois Koeune