Subject: Re: [Ietf-krb-wg] Fwd: Fwd: Re: camellia-cts-cmac as a backup enctype for Kerberos

From: "神田雅透 (IPA)" <[email-masked]>
Date: Mon, 08 Aug 2011 11:03:59 +0900

Hi, Nico,
sorry for my delayed response.

The following list expresses the results of side-channel attack
against Camellia.
After all, we believe that Camellia is equivalently secure to AES
because components of Camellia and of AES are the same;
e.g., s-box and permutation, not arithmetic operations.

---
Power analysis:
[1] Lu Xiao, Howard M. Heys, ``A simple power analysis attack against
the key schedule of the Camellia block cipher,'' Information
Processing Letters, vol. 95, pp. 409-412, Elsevier, 2005.
[2] Lu Xiao, Howard M. Heys, ``An Improved Power Analysis Attack
Against Camellia's Key Schedule,'' http://eprint.iacr.org/2005/338, 2005.
[3] S. Liu, H. Ni, and Y. Liao, ``An improved simple power attack
against Camellia's key schedule, Wuhan University Journal of Natural
Sciences, Vol.12, No .5, pp.591-594.
[4] Elisabeth Oswald and Bart Preneel, A Theoretical Evaluation of
some NESSIE Candidates regarding their Susceptibility towards, Power
Analysis Attacks
[5] Y. Lu, M. P. O’Neill (nee McLoone), J. V. McCanny, Differential
Power Analysis Resistance of Camellia and Countermeasure Strategy,
IEEE International Conference on Field-Programmable Technology (FPT),
Sydney, Australia, 2009.
[6] Panasayya S.V.V.K Yalla, Differential Power Analysis on Light
Weight Implementations of Block Ciphers, A thesis submitted in partial
fulfillment of the requirements for the degree of Master of Science at
George Mason University, 2009.

Cache-timing analysis:
[7] Yukiyasu Tsunoo, Teruo Saito, Tomoyasu Suzaki, Maki Shigeri, and
Hiroshi Miyauchi, Cryptoanalysis of DES Implementation on Computers
with Cache, CHES 2003, LNCS 2779, pp. 62–76, 2003.

Access-driven cache attack:
[8] ZHAO Xin-jie, WANG Tao, ZHENG Yuan-yuan, Cache Timing Analysis on
Camellia Block Cipher, ePrint Archive 2009/354.
[9] ZHAO Xin-jie, WANG Tao, ZHENG Yuan-yuan, Research on Access Drive
Cache Timing Attacks Against Camellia, Chinese Journal of Computers,
Vol.33, No.7, 2010.

Trace-driven Cache Attack:
[10] Rishabh Poddar, Amit Datta and Chester Rebeiro, A Cache Attack on
CAMELLIA, to appear in InfoSecHiComnet 2011.

Fault attack:
[11]Haining Chen, Yongbin Zhou, Wenling Wu, Na Wang, Fault Propagation
Pattern Based DFA on Feistel Ciphers with Application to Camellia, CIT
2010, pp.1050-1057, 2010.
[12] ZHAO Xin-jie, WANG Tao, and Guo Shi-Ze, An Improves Differential
Fault Attack on Camellia, Chinese Journal of Computers, No, 4, pp.613-627.
[13]ZHAO Xin-jie, WANG Tao, Further Improved Differential Fault
Analysis on Camellia by Exploring Fault Width and Depth, ePrint
Archive 2010/026.
[14]Wei Li, Dawu Gu, Juanru Li, Zhiqiang Liu, Ya Liu, Differential
fault analysis on Camellia, Journal of Systems and Software, Volume
83, Issue 5, May 2010, Pages 844-851.

---

Masayuki,

(2011/07/29 23:18), Nico Williams wrote:
> This looks compelling enough, but I have at least one more concern:
> side channels.  Are there software implementations of Camellia that
> are  not subject to various side-channels?
> 
> Nico
> --
> 
> 

_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg

---

From: Michiko Short <[email-masked]>
Date: Tue, 9 Aug 2011 21:00:13 +0000

Side-channel attacks via cache-timing are a major concern for implementers. Microsoft has worked with CPU vendors to develop the AES-NI instructions and added support for AES-NI to Windows. Not only does AES-NI give a performance improvement, it also eliminates the table lookup that leads to the cache-timing attacks. This is our primary defense against AES cache-timing attacks. 

Since there are no Camellia instructions in any mass-market CPUs, it is not equivalent in practice to AES from the point of view of security against side-channel attacks.

Thanks,
Michiko Short 

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of "???? (IPA)"
Sent: Sunday, August 07, 2011 7:04 PM
To: Nico Williams
Cc: [email-masked]; Sam Hartman
Subject: Re: [Ietf-krb-wg] Fwd: Fwd: Re: camellia-cts-cmac as a backup enctype for Kerberos

Hi, Nico,

The following list expresses the results of side-channel attack against Camellia.
After all, we believe that Camellia is equivalently secure to AES because components of Camellia and of AES are the same; e.g., s-box and permutation, not arithmetic operations.

---
Power analysis:
[1] Lu Xiao, Howard M. Heys, ``A simple power analysis attack against the key schedule of the Camellia block cipher,'' Information Processing Letters, vol. 95, pp. 409-412, Elsevier, 2005.
[2] Lu Xiao, Howard M. Heys, ``An Improved Power Analysis Attack Against Camellia's Key Schedule,'' http://eprint.iacr.org/2005/338, 2005.
[3] S. Liu, H. Ni, and Y. Liao, ``An improved simple power attack against Camellia's key schedule, Wuhan University Journal of Natural Sciences, Vol.12, No .5, pp.591-594.
[4] Elisabeth Oswald and Bart Preneel, A Theoretical Evaluation of some NESSIE Candidates regarding their Susceptibility towards, Power Analysis Attacks [5] Y. Lu, M. P. O’Neill (nee McLoone), J. V. McCanny, Differential Power Analysis Resistance of Camellia and Countermeasure Strategy, IEEE International Conference on Field-Programmable Technology (FPT), Sydney, Australia, 2009.
[6] Panasayya S.V.V.K Yalla, Differential Power Analysis on Light Weight Implementations of Block Ciphers, A thesis submitted in partial fulfillment of the requirements for the degree of Master of Science at George Mason University, 2009.

Cache-timing analysis:
[7] Yukiyasu Tsunoo, Teruo Saito, Tomoyasu Suzaki, Maki Shigeri, and Hiroshi Miyauchi, Cryptoanalysis of DES Implementation on Computers with Cache, CHES 2003, LNCS 2779, pp. 62–76, 2003.

Access-driven cache attack:
[8] ZHAO Xin-jie, WANG Tao, ZHENG Yuan-yuan, Cache Timing Analysis on Camellia Block Cipher, ePrint Archive 2009/354.
[9] ZHAO Xin-jie, WANG Tao, ZHENG Yuan-yuan, Research on Access Drive Cache Timing Attacks Against Camellia, Chinese Journal of Computers, Vol.33, No.7, 2010.

Trace-driven Cache Attack:
[10] Rishabh Poddar, Amit Datta and Chester Rebeiro, A Cache Attack on CAMELLIA, to appear in InfoSecHiComnet 2011.

Fault attack:
[11]Haining Chen, Yongbin Zhou, Wenling Wu, Na Wang, Fault Propagation Pattern Based DFA on Feistel Ciphers with Application to Camellia, CIT 2010, pp.1050-1057, 2010.
[12] ZHAO Xin-jie, WANG Tao, and Guo Shi-Ze, An Improves Differential Fault Attack on Camellia, Chinese Journal of Computers, No, 4, pp.613-627.
[13]ZHAO Xin-jie, WANG Tao, Further Improved Differential Fault Analysis on Camellia by Exploring Fault Width and Depth, ePrint Archive 2010/026.
[14]Wei Li, Dawu Gu, Juanru Li, Zhiqiang Liu, Ya Liu, Differential fault analysis on Camellia, Journal of Systems and Software, Volume 83, Issue 5, May 2010, Pages 844-851.

---

Masayuki,