1. Information Security – Theory vs. Reality 0368-4474, Winter 2013-2014Lecture 3:Fault and side-channel attacks on RSA Eran Tromer

2. Fault attacks on RSA On-board discussion. Outline: • Fault attacks on RSA with CRT decryption(on board)[DeMillo, Lipton, On the importance of eliminating errors in cryptographic protocols (section 2)] • Mitigation / countermeasures • Enforce structure (padding) in message • Repeat and compare • Decrypt and compare • Ciphertext blinding/randomization • JVM single memory error

3. More side-channel attacks on RSA

4. ALU multiplier contention attack on square-and-multiply RSA exponentiation MUL SQR SQR SQR SQR measurement • Background:square-and-multiplyexponentiation (on board) time ALU multiplier attack[Aciicmez Seifert 2007]

5. (Simple) power analysis of square-and-multiply decryption RSA [Cryptography Research] • Background: power measurements (on board)

6. Cache attack on sliding-window RSA exponentiation cache set time [Percival 2005,Cache Missing for Fun and Profit]