side_channels: Add SLH DSA report #238
Conversation
reneme
force-pushed
the
aisec/sca/slh-dsa
branch
from
a1ce11e to
d9fac0c
Compare
|
@aewag I rebased this draft to the currrent Also, I fixed a few minor things and used the |
reneme
force-pushed
the
aisec/sca/slh-dsa
branch
from
d9fac0c to
3b7dd03
Compare
|
|
||
| Analysed variants: | ||
|
|
||
| - SphincsPlus-sha2-128s-r3.1, deterministic |
There was a problem hiding this comment.
Maybe we want to test the instance SLH-DSA-SHA2-128s instead. Both share ~99% of the code, but SphincsPlus-sha2-128s-r3.1 is the legacy SPHINCS+ support, while SLH-DSA-SHA2-128s is the final SLH-DSA standard. While I don't think we miss any side-channels when testing only the legacy mode, it looks better on paper with SLH-DSA. Do you think you can execute DATA once with the SLH-DSA instance and quickly verify it, or does it take too much time?
There was a problem hiding this comment.
Thanks for the hint, will do! 👍
| The `treehash` routine detects during execution whether the currently calculated node must be added to the authentication data (:srcref:`[src/lib/pubkey/sphincsplus/sphincsplus_common]/sp_treehash.cpp:64|internal_leaf`). | ||
| If this is the case, a condition in the programme flow is fulfilled and the programme execution is changed. | ||
| This control flow difference is indicated by DATA. | ||
| The difference is not critical because the values of the nodes within these Merkle trees are public. |
There was a problem hiding this comment.
I think the argument is instead: The information about which nodes are part of the authentication path is public. The node values aren't leaked, aren't they?
There was a problem hiding this comment.
You are right that it is observable which nodes are part of the authentication path. I will clarify this.
Just as note: In the treehash routine both (i) which nodes are used and (ii) the values itself are public data.
Co-authored-by: Fabian Albert <[email protected]>
Co-authored-by: Fabian Albert <[email protected]>
Co-authored-by: Fabian Albert <[email protected]>
Co-authored-by: Fabian Albert <[email protected]>
Co-authored-by: Fabian Albert <[email protected]>
Co-authored-by: Fabian Albert <[email protected]>
Co-authored-by: Fabian Albert <[email protected]>
Co-authored-by: Fabian Albert <[email protected]>
No description provided.