On 6/3/2013 10:47 AM, Schmid Alexander wrote:
Hello,
I would like to raise the question if the (3)DES algorithm of the
openSSL library is safe against attacks using DPA and SPA?
If by DPA and SPA you refer to attacks that try to detect the bits
(key or plaintext) processed from subtle variations in the computer
chips power consumption, I don't think it is possible for any
software implementation to protect against this unless it is tied
to a specific version of a specific CPU chip (such as "AMD Opteron
model XXXX stepping Z clocked at its default frequency of Y.YYY GHz").
For the kind of general purpose computer hardware on which OpenSSL
is typically used, there are more potent attacks available to anyone
with direct electromagnetic access to the computers printed circuit
board ans it is a standard security requirement to physically prevent
such access, thereby preventing any and all attacks requiring the
attacker to have access to measure or manipulate any of the electrical
signals that could be affected by the contents of secure bits.
If yes, from which version on?
Is there an official certification to prove this?
Beste Grüße / Best regards
Alexander Schmid
Enjoy
Jakob
--
Jakob Bohm, CIO, Partner, WiseMo A/S. http://www.wisemo.com
Transformervej 29, 2730 Herlev, Denmark. Direct +45 31 13 16 10
This public discussion message is non-binding and may contain errors.
WiseMo - Remote Service Management for PCs, Phones and Embedded
______________________________________________________________________
OpenSSL Project http://www.openssl.org
User Support Mailing List [email protected]
Automated List Manager [email protected]
