[Cryptech Tech] Low level side channels

[Joachim Strömbergson]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Aloha!

Randy Bush wrote:
>> Fredrik Thulin wrote:
>>> http://blog.erratasec.com/2015/03/x86-is-high-level-language.html?m=1
>
>>> 
> i kinda knew but never thought through how bad an effect on things
> such as 'constant time' algorithms.

What makes the situation better/worse (depending on viewpoint) is that
from SW/ISA point of view it is hard to predict the uop sequencing. That
makes it harder to control. But it also makes it harder to predict side
channel patterns.

But since the target applications are limited (tight algo loops in
OpenSSL for example). It should be possible to collect side channel
patterns from different generations of x86 for interesting algorithms
and implementations and use that to try and identify stuff from outside.
If one have the resources and time this should be quite feasible.

A defender could do the same to test methods of obfuscating the
execution. Of course.

- -- 
Med vänlig hälsning, Yours

Joachim Strömbergson - Alltid i harmonisk svängning.
========================================================================
 Joachim Strömbergson          Secworks AB          joachim at secworks.se
========================================================================
-----BEGIN PGP SIGNATURE-----
Version: GnuPG/MacGPG2 v2
Comment: GPGTools - http://gpgtools.org
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iQIcBAEBCAAGBQJVE7ZUAAoJEF3cfFQkIuyNio0P/21EU4w09/hx7CbfgWyQgHGJ
JzWDBraKv0q03kd3jmmZX78IWfizWuGYMps80gQggECHkq25eUnIx/CvNoE5qirK
LE31q76TJbGptQVlg2L74V171Hy0rKGbRk6miNt0b4oIKRVwu/VmKBWjUeTm/JH+
nKUPpuaKRcjop52BfdskzJIT0qL7grNSGiJw6LBkZbPZVwjL5h+pZV6F6KpkNU2g
dzWxrHpIYn+ZqjOBydNQLNWHF4672aalkRFWJsNih421LCa//QU1ZdVL/2otFrnR
9dGXU4UPHgmxMZUqFqaEHNiFyPtXbSTXbF7KkkBJrEtSAWEpDn6VfSOS7QZDboCC
2r8iR9oJBqeVku/LBL7RUQnkcqWYcuaX19k1a2jMmbdEoudAWNZzZAQbbIWKSUUP
gpSwV6Tq8kb5nZz0aVj09vchpuOos1WbVtat9LquNRHKygRQy4SZfLfyKz0qxm6c
Ah+2cb5EFdd5J+zJQrAqTs9PV3kr4Bro3YIlHiSzJKW+FEqq5uyeT1L5LwswUwUg
KQrUyzct5/xiVZctdCMAyo+dlPkbY3e63/bFLXeITW/JGWOHoUTzQbdpRIdFnGwS
Fg66Dth4TnjOFVbOm5XhiC+BIJo9/8pzywT08qNsH3V4sz5FHyJ7inkuDn3x6dwy
40va3azGrCyjUJPq+Qka
=woOG
-----END PGP SIGNATURE-----