5 ms·

"The attack requires measuring a few thousand ECDSA signatures" - so not quite feasible by bumping into the target in a crowded subway.

by liotier 11y ago

digi_owl 11y ago
And this is the kind of context i find often missing from security discussions. It will still protect against anything short of a determined attacker with direct access to the hardware for an extended period. Very little is secure against such a scenario, even less so if the attacker don't care about the defender knowing after the fact. But all too often security research seems to consider anything that can be broken, even with the most complicated and time intensive of processes, as insecure.
- atonse 11y ago
  Correct – the fact that there exists a possible way to extract these secrets is a chink in the armor. It's like how SHA1 started getting out of favor as soon as they started finding a couple of collisions. Interesting that Apple already fixed this in iOS 9. Makes me wonder what kinds of crazy tests their security team must be doing, that they can mitigate such things.
  - JonathonW 11y ago
    These sorts of side channel vulnerabilities aren't some sort of new revelation-- the notion dates at least back to 2002 (per the authors' cited references). For example, one of the design goals of DJB's NaCl [1] is to mitigate side-channel vulnerabilities, specifically calling out data flow from secrets to load addresses (which has been used to break AES via a timing attack) and data flow from secrets to branch conditions (which is the sort of thing that's happening here-- where you can see secret-dependent patterns in the number and timing of operations in ECDSA computations) [2]. What's novel here is just how cheaply they're able to carry out these side-channel attacks. [1] https://nacl.cr.yp.to/ https://nacl.cr.yp.to/ [2] http://cr.yp.to/highspeed/coolnacl-20120725.pdf http://cr.yp.to/highspeed/coolnacl-20120725.pdf -- see section 3, Core security features and their impact
  - beagle3 11y ago
    SHA1 fell out of favor long before any collision was found -- it fell out of favor in 2012 or even earlier, when it was clear that one will be found sooner than later. FWIW, there is no publicly known SHA1 collision yet. There's a known freestart collision, and a real world (non-freestart) collision is expected to be found within the next couple of months by the same group (the search is already running on their cluster - and the expected time to success is a couple of months). They have already found the first pair that they need out of two.
- userbinator 11y ago
  But all too often security research seems to consider anything that can be broken, even with the most complicated and time intensive of processes, as insecure. That's basically the whole point of security research - to find any weaknesses and try to fix them. It sounds great on the surface, but the logical conclusion of reaching "ultimate security" is not so pleasant...
- Dylan16807 11y ago
  This attack requires some time, but the general strategy works from feet away, or from the other side of a wall, or from far away on a VGA cable headed to a projector. Don't dismiss it as requiring "direct access to the hardware".
- rcthompson 11y ago
  A weakness that takes minutes or hours to exploit today isn't going to get stronger over time, it's going to get weaker, maybe to the point of only requiring a few seconds. The point of this kind of security research is to provide ample warning before an attack becomes practical.

"The attack requires measuring a few thousand ECDSA signatures" - so not quite feasible by bumping into the target in a crowded subway.

by liotier 11y ago

"The attack requires measuring a few thousand ECDSA signatures" - so not quite feasible by bumping into the target in a crowded subway.

digi_owl 11y ago

And this is the kind of context i find often missing from security discussions. It will still protect against anything short of a determined attacker with direct access to the hardware for an extended period. Very little is secure against such a scenario, even less so if the attacker don't care about the defender knowing after the fact. But all too often security research seems to consider anything that can be broken, even with the most complicated and time intensive of processes, as insecure.

atonse 11y ago
Correct – the fact that there exists a possible way to extract these secrets is a chink in the armor. It's like how SHA1 started getting out of favor as soon as they started finding a couple of collisions. Interesting that Apple already fixed this in iOS 9. Makes me wonder what kinds of crazy tests their security team must be doing, that they can mitigate such things.
- JonathonW 11y ago
  These sorts of side channel vulnerabilities aren't some sort of new revelation-- the notion dates at least back to 2002 (per the authors' cited references). For example, one of the design goals of DJB's NaCl [1] is to mitigate side-channel vulnerabilities, specifically calling out data flow from secrets to load addresses (which has been used to break AES via a timing attack) and data flow from secrets to branch conditions (which is the sort of thing that's happening here-- where you can see secret-dependent patterns in the number and timing of operations in ECDSA computations) [2]. What's novel here is just how cheaply they're able to carry out these side-channel attacks. [1] https://nacl.cr.yp.to/ https://nacl.cr.yp.to/ [2] http://cr.yp.to/highspeed/coolnacl-20120725.pdf http://cr.yp.to/highspeed/coolnacl-20120725.pdf -- see section 3, Core security features and their impact
- beagle3 11y ago
  SHA1 fell out of favor long before any collision was found -- it fell out of favor in 2012 or even earlier, when it was clear that one will be found sooner than later. FWIW, there is no publicly known SHA1 collision yet. There's a known freestart collision, and a real world (non-freestart) collision is expected to be found within the next couple of months by the same group (the search is already running on their cluster - and the expected time to success is a couple of months). They have already found the first pair that they need out of two.
userbinator 11y ago
But all too often security research seems to consider anything that can be broken, even with the most complicated and time intensive of processes, as insecure. That's basically the whole point of security research - to find any weaknesses and try to fix them. It sounds great on the surface, but the logical conclusion of reaching "ultimate security" is not so pleasant...
Dylan16807 11y ago
This attack requires some time, but the general strategy works from feet away, or from the other side of a wall, or from far away on a VGA cable headed to a projector. Don't dismiss it as requiring "direct access to the hardware".
rcthompson 11y ago
A weakness that takes minutes or hours to exploit today isn't going to get stronger over time, it's going to get weaker, maybe to the point of only requiring a few seconds. The point of this kind of security research is to provide ample warning before an attack becomes practical.