liveBook · Manning

Side-channel attack

As explained in Hacking Cryptography

Side-channel analysis extracts information about secret computations from observable implementation behavior such as timing, power, or electromagnetic emissions.

A side-channel attack extracts secret information from observable implementation behavior rather than from the intended cryptographic output. Timing, power consumption, electromagnetic emissions, and processor effects can reveal which operations a secret computation performs. section 10.4.2 section 10.5

Recovering an exponent from power

Square-and-multiply processes each exponent bit with a squaring and, for a 1 bit, an additional multiplication. Because multiplication consumes more resources than squaring, an oscilloscope attached to a device can expose differing power levels and help recover an RSA private exponent. Noise and superscalar processors complicate analysis, while machine learning increasingly automates it. section 10.4.2

Table 10.1 Square-and-multiply algorithm for exponent \(42 = (101010)_2\)
Previous answer Bit processed Previous answer squared Multiplied by \(x\) New answer
\(1\) \(1\) \(1\) \(x\) \(x^1 = x^{(1)_2}\)
\(x\) \(0\) \(x^2\) - \(x^2 = x^{(10)_2}\)
\(x^2\) \(1\) \(x^4\) \(x^5\) \(x^5 = x^{(101)_2}\)
\(x^5\) \(0\) \(x^{10}\) - \(x^{10} = x^{(1010)_2}\)
\(x^{10}\) \(1\) \(x^{20}\) \(x^{21}\) \(x^{21} = x^{(10101)_2}\)
\(x^{21}\) \(0\) \(x^{42}\) - \(x^{42} = x^{(101010)_2}\)

Trace square-and-multiply for exponent 42 and see how each processed bit determines whether multiplication occurs. section 10.4.2

Secret-dependent branching creates the same general weakness. A comparison, loop, or array access that changes control flow can alter execution time; speculative execution and cache behavior may make the difference measurable without physical probing. section 10.5

Reduce side-channel exposure with implementation discipline:

  • Use constant-time algorithms that perform a consistent sequence of operations regardless of secret inputs. section 10.4.2
  • Avoid branching and iterating on sensitive values, and avoid secret-dependent indexing. section 10.9 section 10.5
  • Test implementations for timing differences and treat lower-level optimization as security-sensitive rather than merely performance-oriented. section 10.4.2 section 10.5

How Hacking Cryptography covers it

How deep it goes
Explains power traces, timing leakage, processor behavior, and constant-time exponentiation, but defers advanced optimization details.
Examples
Uses RSA power traces, square-and-multiply for exponent 42, and C branch-prediction programs comparing branching with branchless execution.
What it assumes
Assumes basic cryptographic implementation knowledge while explaining exponentiation steps, processor prediction, and leakage mechanisms concretely.
What you can do after
Diagnose/debug secret-dependent timing and power leakage, then replace variable operation patterns with constant-time designs.
How it connects
Connects timing attacks with constant-time implementations, secret-dependent control flow, speculative execution, and RSA exponentiation.
Cover of Hacking Cryptography
liveBookmanning.com
Read Hacking Cryptography on liveBook Get the book at manning.com

Also explained in

Compare how 3 books explain side-channel attack →

Related concepts

This explainer was generated by Manning's knowledge graph from the text of Hacking Cryptography. The section links point to the parts of the book it draws on.