this post was submitted on 11 Sep 2023
90 points (97.9% liked)
Programming
17398 readers
145 users here now
Welcome to the main community in programming.dev! Feel free to post anything relating to programming here!
Cross posting is strongly encouraged in the instance. If you feel your post or another person's post makes sense in another community cross post into it.
Hope you enjoy the instance!
Rules
Rules
- Follow the programming.dev instance rules
- Keep content related to programming in some way
- If you're posting long videos try to add in some form of tldr for those who don't want to watch videos
Wormhole
Follow the wormhole through a path of communities [email protected]
founded 1 year ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
That’s a very good explanation.
Now forget you read that and never ever implement that yourself in production situations. Instead rely on hardware implementations and established libraries.
AES is practically impossible to implement without introducing huge side channels. Verification of side channel resistance is a huge issue.
The author says almost exactly the same thing at the end. Maybe it should have been at the beginning.
The side channel resistance includes such matters as ensuring that the cypher takes the same amount of time, regardless of the key, but also such super-sneaky insights as the amount of power used to run the cypher, which can be measured from the CPU temperature. Every bit of the cypher that you can be sure of makes it easier to guess the rest. And even if you coded this algorithm in assembly, the CPU will interpret it as microcode and run that, potentially leaving you vulnerable - this is not straightforward stuff.
Like vzq says, implementing this properly is for a cross-disciplinary team of experts in their fields.
Yes, but (there is always a but) it does not apply if you implement off-line encryption. Meaning no on-line service encrypting / decrypting attacker provided data (such as SSL / TLS / HTTPS). Meaning if you are running the cipher on your own computer with your own keys / plaintexts / ciphertexts. There is nobody to snoop time differences or power usage differences when using different key / different ciphertext. Then I would suggest this is fine. The only one who can attack you is yourself. In fact, I implemented AES from scratch in C89 language, this source code is at the same time compatible with C++14 constexpr evaluation mode. I also implemented the Serpent cipher, Serpent was an AES candidate back then when there were no AES and Rijndael was not AES yet. The code is on my GitHub page.