Re: Power analysis of AES candidates

1999-09-15 Thread Eugene Leitl
Eli Brandt writes: If so, doubling the cap size halves the cutoff frequency (right?), halving the leaked power. Integrating runs gives signal voltage linear in n and noise voltage sqrt(n); voltage ratio is sqrt; power ratio is linear. So leaked-signal power is Theta(

Re: Power analysis of AES candidates

1999-09-15 Thread Markus Kuhn
Andreas Bogk wrote on 1999-09-15 00:04 UTC: The usual setup for DPA involves a 10 Ohm resistor which sits in the power supply and measuring the voltage across that resistor. The countermeasure we're talking about is an on-chip capacitor that smoothes the power consumption, or a power supply

Re: Power analysis of AES candidates

1999-09-15 Thread Eli Brandt
Eugene Leitl wrote: I don't quite understand your handwave analysis: if we use supercapacitors we can power the embedded unit for hours straight. Okay, so you charge and then disconnect from the power source to execute. I got the impression we were talking about using the cap as you would in

Re: Power analysis of AES candidates

1999-09-15 Thread Arnold Reinhold
At 1:35 PM -0700 9/14/99, John Gilmore wrote: At 10:32 AM -0700 9/13/99, Eugene Leitl wrote: Why don't you just erase flash when a pressure change (hull breach) is detected. Using double-walled hull, to look for shortcuts. You can also couple this to light detection, and whatnot. Arnold

Re: Power analysis of AES candidates

1999-09-14 Thread Arnold Reinhold
At 10:32 AM -0700 9/13/99, Eugene Leitl wrote: Why don't you just erase flash when a pressure change (hull breach) is detected. Using double-walled hull, to look for shortcuts. You can also couple this to light detection, and whatnot. Andreas Bogk writes: Russell Nelson [EMAIL PROTECTED]

Re: Power analysis of AES candidates

1999-09-14 Thread Eugene Leitl
John Gilmore writes: What are you guys talking about? Differential power analysis doesn't require any physical attack, nor does it deal with voltage variations. (You are probably thinking of Shamir's fault-injection You can't do differential power analysis if you supply power

Re: Power analysis of AES candidates

1999-09-14 Thread David Honig
At 01:35 PM 9/14/99 -0700, John Gilmore wrote: What are you guys talking about? Differential power analysis doesn't The power analysis thread mutated into a tamper-react thread without changing the Subject line. At 10:32 AM -0700 9/13/99, Eugene Leitl wrote: Why don't you just erase flash

Re: Power analysis of AES candidates

1999-09-14 Thread Eli Brandt
Andreas Bogk wrote: The usual setup for DPA involves a 10 Ohm resistor which sits in the power supply and measuring the voltage across that resistor. The countermeasure we're talking about is an on-chip capacitor that smoothes the power consumption, [...] Has this been analyzed? It's got to

Re: Power analysis of AES candidates

1999-09-14 Thread David Honig
At 02:58 PM 9/14/99 -0700, Eugene Leitl wrote: You can't do differential power analysis if you supply power photonically to an encapsulated unit. Interesting. Such supplies have been proposed for medical gear, where you need absolute isolation. Intense light, reflector, Si cells. A few cm

Re: Power analysis of AES candidates

1999-08-31 Thread John Kelsey
-BEGIN PGP SIGNED MESSAGE- [ To: Perry's Crypto List ## Date: 08/30/99 ## Subject: Re: Power analysis of AES candidates ] From: "William Whyte" [EMAIL PROTECTED] To: "Cryptography@C2. Net" [EMAIL PROTECTED] Subject: Power analysis of AES candidates Date: Wed,

Re: Power analysis of AES candidates

1999-08-31 Thread Russell Nelson
John Kelsey writes: There's some question about how hard it will be to design hardware that will be DPA-resistant for different algorithms. Big on-chip caps. Lithium batteries. Tamper-resistant housings. That's what Dallas Semiconductor uses for its 1-Wire devices, including the famous