Subject: [Cfrg] Upcoming competition deadlines

From: Watson Ladd <[email-masked]>
Date: Wed, 5 Mar 2014 18:10:06 -0800

Dear all,
The Password Hashing Competition and CAESER have deadlines coming up
soon. I strongly encourage anyone interested in these topics, either
as an implementor or designer, to pay attention. It would be
particularly useful to understand usecases in more detail than we do
now. Comments would be strongly helpful for both competitions.

Secondly, a major bug in OpenSSL's implementation of the SEC p256k
implementation was discovered and exploited. The issue was side
channels in control flow and memory accesses, together with new
techniques for using the information gathered to extract private keys.

I think it's clear that we need a side-channels draft: since people
seem to vehemently disagree about ladd-safecurves, and there are some
open technical questions about what formats are good, I'm going to
redirect my efforts to getting the side-channels draft further along.
Comments on what would make it useful/scarier would be greatly
appreciated.

Sincerely,
Watson Ladd

---

From: Hanno Böck <[email-masked]>
Date: Thu, 6 Mar 2014 10:57:38 +0100

On Wed, 5 Mar 2014 18:10:06 -0800

> Comments on what would make it useful/scarier would be greatly

Just some quick thoughts on that: I think this is remarkably
challenging. Because you're faced with a pretty tough question: What
exactly is a "side channel"?

We can probably come up with a formal definition of a timing side
channel easily. But "side channels" in general are an almost infinite
amunt of things. You could probably sum them up as "every information
about keys and encrypted messages that leaves a cryptosystem through
any kind of channel, including physics".

It's probably just plain impossible to build any kind of system that
does calculations without affecting its surrounding physics based on
the content of the calculation. That said: We probably have to face the
fact that a side channel-free system is impossible.

So any kind of side channel protection can only work with some kind of
heuristics. We can lower the information impact on the outside world
(this is what RSA blinding does for example).

-- 
Hanno Böck
http://hboeck.de/

mail/jabber: [email-masked]
GPG: BBB51E42