If a single bit was known through all states in AES, which would cause the most information to leak?











up vote
5
down vote

favorite












This question is motivated by some bad Verilog. Due to someone being sloppy with port assignments and a output statement, I have an AES core that has a single-bit from a S-Box in the key schedule tied to a pin. This was caught in my audit of the HDL; however, it's sort of a neat error. Due to the nature of the hardware, I can get 10-bits of information about the key out of it as it's configured for AES-128 and it's a very parallel implementation (it's actually the LSB of the squaring module in the S-Box on the lowest byte of the key). This got me thinking:



If you are an attacker and could watch one bit of AES-128 for 10 rounds, which bit would you choose to recover the most useful information? I feel it would be a bit in the key schedule.






aes side-channel-attack







share|improve this question


























    up vote
    5
    down vote

    favorite












    This question is motivated by some bad Verilog. Due to someone being sloppy with port assignments and a output statement, I have an AES core that has a single-bit from a S-Box in the key schedule tied to a pin. This was caught in my audit of the HDL; however, it's sort of a neat error. Due to the nature of the hardware, I can get 10-bits of information about the key out of it as it's configured for AES-128 and it's a very parallel implementation (it's actually the LSB of the squaring module in the S-Box on the lowest byte of the key). This got me thinking:



    If you are an attacker and could watch one bit of AES-128 for 10 rounds, which bit would you choose to recover the most useful information? I feel it would be a bit in the key schedule.






    aes side-channel-attack







    share|improve this question
























      up vote
      5
      down vote

      favorite









      up vote
      5
      down vote

      favorite











      This question is motivated by some bad Verilog. Due to someone being sloppy with port assignments and a output statement, I have an AES core that has a single-bit from a S-Box in the key schedule tied to a pin. This was caught in my audit of the HDL; however, it's sort of a neat error. Due to the nature of the hardware, I can get 10-bits of information about the key out of it as it's configured for AES-128 and it's a very parallel implementation (it's actually the LSB of the squaring module in the S-Box on the lowest byte of the key). This got me thinking:



      If you are an attacker and could watch one bit of AES-128 for 10 rounds, which bit would you choose to recover the most useful information? I feel it would be a bit in the key schedule.






      aes side-channel-attack







      share|improve this question













      This question is motivated by some bad Verilog. Due to someone being sloppy with port assignments and a output statement, I have an AES core that has a single-bit from a S-Box in the key schedule tied to a pin. This was caught in my audit of the HDL; however, it's sort of a neat error. Due to the nature of the hardware, I can get 10-bits of information about the key out of it as it's configured for AES-128 and it's a very parallel implementation (it's actually the LSB of the squaring module in the S-Box on the lowest byte of the key). This got me thinking:



      If you are an attacker and could watch one bit of AES-128 for 10 rounds, which bit would you choose to recover the most useful information? I feel it would be a bit in the key schedule.






      aes side-channel-attack




      aes side-channel-attack






      share|improve this question













      share|improve this question











      share|improve this question




      share|improve this question










      asked 4 hours ago









      b degnan

      1,4351624




      1,4351624






















          1 Answer
          1






          active

          oldest

          votes

















          up vote
          5
          down vote














          If you are an attacker and could watch one bit of AES-128 for 10 rounds, which bit would you choose to recover the most useful information? I feel it would be a bit in the key schedule.




          Actually, I'd expect a leak of one of the internal state bits would give the attacker more information.



          The key schedule is static, and so if you leak 10 bits, well, you still have (at best) 118 bits of uncertainty in the key; no where close to small enough to be useful for an attacker.



          However, if you leak the internal state, you can look at (say) one of the internal state bits after each round. The advantage there is that we can look at the bits for a number of known plaintexts/ciphertexts; this yields considerably more information. After 1 round, an internal bit is a function of the plaintext and 33 key bits; by looking at a number of plaintexts, we can get enough information to deduce those 33 key bits.






          share|improve this answer





















            Your Answer





            StackExchange.ifUsing("editor", function () {
            return StackExchange.using("mathjaxEditing", function () {
            StackExchange.MarkdownEditor.creationCallbacks.add(function (editor, postfix) {
            StackExchange.mathjaxEditing.prepareWmdForMathJax(editor, postfix, [["$", "$"], ["\\(","\\)"]]);
            });
            });
            }, "mathjax-editing");

            StackExchange.ready(function() {
            var channelOptions = {
            tags: "".split(" "),
            id: "281"
            };
            initTagRenderer("".split(" "), "".split(" "), channelOptions);

            StackExchange.using("externalEditor", function() {
            // Have to fire editor after snippets, if snippets enabled
            if (StackExchange.settings.snippets.snippetsEnabled) {
            StackExchange.using("snippets", function() {
            createEditor();
            });
            }
            else {
            createEditor();
            }
            });

            function createEditor() {
            StackExchange.prepareEditor({
            heartbeatType: 'answer',
            convertImagesToLinks: false,
            noModals: true,
            showLowRepImageUploadWarning: true,
            reputationToPostImages: null,
            bindNavPrevention: true,
            postfix: "",
            imageUploader: {
            brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
            contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
            allowUrls: true
            },
            noCode: true, onDemand: true,
            discardSelector: ".discard-answer"
            ,immediatelyShowMarkdownHelp:true
            });


            }
            });














            draft saved

            draft discarded


















            StackExchange.ready(
            function () {
            StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fcrypto.stackexchange.com%2fquestions%2f65890%2fif-a-single-bit-was-known-through-all-states-in-aes-which-would-cause-the-most%23new-answer', 'question_page');
            }
            );

            Post as a guest















            Required, but never shown

























            1 Answer
            1






            active

            oldest

            votes








            1 Answer
            1






            active

            oldest

            votes









            active

            oldest

            votes






            active

            oldest

            votes








            up vote
            5
            down vote














            If you are an attacker and could watch one bit of AES-128 for 10 rounds, which bit would you choose to recover the most useful information? I feel it would be a bit in the key schedule.




            Actually, I'd expect a leak of one of the internal state bits would give the attacker more information.



            The key schedule is static, and so if you leak 10 bits, well, you still have (at best) 118 bits of uncertainty in the key; no where close to small enough to be useful for an attacker.



            However, if you leak the internal state, you can look at (say) one of the internal state bits after each round. The advantage there is that we can look at the bits for a number of known plaintexts/ciphertexts; this yields considerably more information. After 1 round, an internal bit is a function of the plaintext and 33 key bits; by looking at a number of plaintexts, we can get enough information to deduce those 33 key bits.






            share|improve this answer

























              up vote
              5
              down vote














              If you are an attacker and could watch one bit of AES-128 for 10 rounds, which bit would you choose to recover the most useful information? I feel it would be a bit in the key schedule.




              Actually, I'd expect a leak of one of the internal state bits would give the attacker more information.



              The key schedule is static, and so if you leak 10 bits, well, you still have (at best) 118 bits of uncertainty in the key; no where close to small enough to be useful for an attacker.



              However, if you leak the internal state, you can look at (say) one of the internal state bits after each round. The advantage there is that we can look at the bits for a number of known plaintexts/ciphertexts; this yields considerably more information. After 1 round, an internal bit is a function of the plaintext and 33 key bits; by looking at a number of plaintexts, we can get enough information to deduce those 33 key bits.






              share|improve this answer























                up vote
                5
                down vote










                up vote
                5
                down vote










                If you are an attacker and could watch one bit of AES-128 for 10 rounds, which bit would you choose to recover the most useful information? I feel it would be a bit in the key schedule.




                Actually, I'd expect a leak of one of the internal state bits would give the attacker more information.



                The key schedule is static, and so if you leak 10 bits, well, you still have (at best) 118 bits of uncertainty in the key; no where close to small enough to be useful for an attacker.



                However, if you leak the internal state, you can look at (say) one of the internal state bits after each round. The advantage there is that we can look at the bits for a number of known plaintexts/ciphertexts; this yields considerably more information. After 1 round, an internal bit is a function of the plaintext and 33 key bits; by looking at a number of plaintexts, we can get enough information to deduce those 33 key bits.






                share|improve this answer













                If you are an attacker and could watch one bit of AES-128 for 10 rounds, which bit would you choose to recover the most useful information? I feel it would be a bit in the key schedule.




                Actually, I'd expect a leak of one of the internal state bits would give the attacker more information.



                The key schedule is static, and so if you leak 10 bits, well, you still have (at best) 118 bits of uncertainty in the key; no where close to small enough to be useful for an attacker.



                However, if you leak the internal state, you can look at (say) one of the internal state bits after each round. The advantage there is that we can look at the bits for a number of known plaintexts/ciphertexts; this yields considerably more information. After 1 round, an internal bit is a function of the plaintext and 33 key bits; by looking at a number of plaintexts, we can get enough information to deduce those 33 key bits.







                share|improve this answer












                share|improve this answer



                share|improve this answer










                answered 1 hour ago









                poncho

                89.4k2134229




                89.4k2134229






























                    draft saved

                    draft discarded




















































                    Thanks for contributing an answer to Cryptography Stack Exchange!


                    • Please be sure to answer the question. Provide details and share your research!

                    But avoid …



                    • Asking for help, clarification, or responding to other answers.

                    • Making statements based on opinion; back them up with references or personal experience.


                    Use MathJax to format equations. MathJax reference.


                    To learn more, see our tips on writing great answers.





                    Some of your past answers have not been well-received, and you're in danger of being blocked from answering.


                    Please pay close attention to the following guidance:


                    • Please be sure to answer the question. Provide details and share your research!

                    But avoid …



                    • Asking for help, clarification, or responding to other answers.

                    • Making statements based on opinion; back them up with references or personal experience.


                    To learn more, see our tips on writing great answers.




                    draft saved


                    draft discarded














                    StackExchange.ready(
                    function () {
                    StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fcrypto.stackexchange.com%2fquestions%2f65890%2fif-a-single-bit-was-known-through-all-states-in-aes-which-would-cause-the-most%23new-answer', 'question_page');
                    }
                    );

                    Post as a guest















                    Required, but never shown





















































                    Required, but never shown














                    Required, but never shown












                    Required, but never shown







                    Required, but never shown

































                    Required, but never shown














                    Required, but never shown












                    Required, but never shown







                    Required, but never shown







                    -

                    Popular posts from this blog

                    Ellipse (mathématiques)

                    Image
                    Pour les articles homonymes, voir Ellipse. L'ellipse est le lieu des points dont la somme des distances à deux points fixes, dits foyers, est constante. Section du cône ou projection du cercle. En géométrie, une ellipse est une courbe plane fermée obtenue par l’intersection d’un cône de révolution avec un plan, à condition que celui-ci coupe l'axe de rotation du cône ou du cylindre : c'est une conique d'excentricité strictement comprise entre 0 et 1. On peut également la définir comme le lieu des points dont la somme des distances à deux points fixes, dits foyers, est constante (sa construction par la méthode du jardinier est très simple). Dans la vie courante, l’ellipse est la forme qu'on perçoit en regardant un cercle en perspective, ou la figure formée par l’ombre d'un disque sur une surface plane. On retrouve aussi, en première approximation [ 1 ] , des ellipses dans les trajectoires des corps célestes (planètes, comètes ou satellites arti...
                    Read more

                    Quarter-circle Tiles

                    Image
                    up vote 0 down vote favorite I have $99$ identical square tiles, each with a quarter-circle drawn on it like this: [asy] size(1.5cm); draw(Arc((2,0),1,90,180),red+1); draw((0,0)--(2,0)--(2,2)--(0,2)--(0,0)); [/asy] When I arrange the tiles in a $9times 11$ rectangular grid, each with a random orientation, what is the expected value of the number of full circles I form? I think this problem has to do with finding the chance any given 2x2 square has a circle, but I can't find it. expected-value share | cite | improve this question asked Nov 20 at 15:03 6minecraftninja 1 2 ...
                    Read more

                    Mont Emei

                    Image
                    Mont Emei.mw-parser-output .entete.map{background-image:url("//upload.wikimedia.org/wikipedia/commons/7/7a/Picto_infobox_map.png")} Vue du sommet Wanfo du mont Emei Géographie Altitude 3 099  m , Wanfo Coordonnées 29° 31′ 11″ nord, 103° 19′ 57″ est Administration Pays   Chine Province Sichuan Ville-préfecture Leshan Géolocalisation sur la carte : Sichuan Mont Emei Géolocalisation sur la carte : Chine Mont Emei modifier   Paysage panoramique du mont Emei, incluant le paysage panoramique du grand Bouddha de Leshan *   Patrimoine mondial de l'UNESCO Passerelle en bois sur le versant ouest Pays   Chine Subdivision Sichuan Type Mixte Critères (iv) (vi) (x) Superficie 15 400 ha Numéro d’identification 779 Zone géographique Asie et Pacifique  ** Année d’inscription 1996 (20 e session) * Descriptif officiel UNESCO ** Classification géog...
                    Read more