If an application handles important secrets like password, how important is side channel safety for this application?
Are their circumstances/methods in which its still safe to handle sensitive secrets with such an application?
All about threat models.
In general, many cryptographic libraries handle the most obvious of side channel attacks that bleed implementation details from software. of course, dragons beware of applications that implement some of that on their own.
I’d consider this a hard requirement for password managers or cryptographic applications of any sort to mitigate. Outside of that, it’s dealers choice.
Many side channel attacks require physical access to a machine, unless there are some that can confidently be conducted over a network (perhaps?), so server based applications likely won’t focus as hard on this part. but information can leak in plenty of other dumb ways outside of side channels which will be way more preferred to find and exploit.
1 Like
if you see someone with a evil snide mustache with an oscilloscope in their hand eyeing your computer, proceed to vacate the area until you find a safe area away from said individuals.
/s aside, if it requires physical access, they will need your device. having at rest encryption and shutting your computer off when not using it largely makes this not a big deal for most people.
1 Like
Do physical access means access in person or also via an application running on a device that is closely to the device to perform the attack against, or even an application on the same hardware?
Aren’t server especially vulnerable to side channel attacks, while side channel attacks on local machines are far less likely then on servers?
In the security section of the KeePass documentation they say:
Side-channel attacks try to gain information from a system by observing its behavior (e.g. the duration and the power consumption of certain operations). On servers, side-channel attacks are a real threat. On client devices (PCs), side-channel attacks are more difficult (more noise, etc.); there are ideas how some might work in theory, but we are not aware of any real attack in practice. For example, the attack described in the article ‘The Spy in the Sandbox / Side-Channel Attacks in Web Browsers’ was interesting (JavaScript code was able to detect certain user interactions), but not a real threat (no extraction of sensitive data, as mentioned explicitly in the article). This may or may not change in the future. Note that this has nothing to do with cloud storage; KeePass encrypts/decrypts a database file on a client device, and thus it is irrelevant where the database file is stored (for side-channel attacks). Furthermore, there are side-channel attacks that neither Argon2d nor Argon2id (nor Argon2i, nor any other key derivation function) protects against (e.g. Spectre/Meltdown side-channel attacks, which allow spyware to read all memory).
In the case of KeePass, we currently recommend Argon2d instead of Argon2id, because we believe that a better protection against a really existing threat (password cracking using GPUs/ASICs is state of the art) is more important than a protection against certain side-channel attacks that may or may not become a problem on client devices in the future. If you worry about side-channel attacks (and are willing to sacrifice some GPU/ASIC resistance) or if you are developing a software where side-channel attacks could be a problem (e.g. a server service that operates with KeePass database files), use Argon2id.
Side note: the IRTF CFRG Argon2 Internet standard recommends Argon2id by default. For server applications, Argon2id is in general indeed more suitable than Argon2d, but our situation (client device) is different, as mentioned above.
Source: Security - KeePass
If KeePass is right, then I think it would not be a hard requirement for local machines.
depends on what you mean by side channel. My focus was on hardware based attacks (physical access). software based side channels I suppose I didn’t have a term for, but its leaking information about the application without physical access buy perhaps access to run the application (let’s assume the attacked logged into your PC). for example, timing attacks don’t necessitate hardware access, and often result from non constant comparisons.
side channel attacks unrelated to cryptography I left out of scope, but essentially a server can return plenty of accidental information. for example, if a server returns if an email exists (like on login screen) , this allows enumeration of accounts. this isn’t cryptographic side channel, but I’d classify this as a user enumeration vulnerability. I don’t say this is side channel, as I leave side channel verbage specifically to cryptography. maybe I’m wrong in this, but even Wikipedia focuses on cryptographic references of side channels. you may be able to do some of these that are software focused based on response information, but that’s a different story.
servers are subject to the entire internet to scan, while local apps require access to the device. this is why they say servers are at more risk.