3 ms·

So let me get this straight, from what I gather in the abstract, I can't consider ANY information on my VPS to be secure? They can extract private keys, how lon

• neopallium 10y ago
  The attack doesn't give them access to all information from another VPS on the same host. The are using timing analysis to detect what code the other VPS is executing and finding the private key from the noise caused by the victims VPS. Crypto libraries can be fixed to prevent side-channel attacks like this. The article says that libgcrypt has already been patched.
• lstodd 10y ago
  You can not consider anything on a VPS secure. The host machine has it all, anyone who has access to the host can clone your entire VPS at will, RAM and all, what security are you talking about? (you can't be sure if you rent a physical server either, but that's another topic) Besides, while the paper talks about extracting RSA keys, nothing prevents extraction of any other kind of data using the same methodology. So even if people with host acccess overlook you, nothing is secure from your neighbours. It's just that encryption keys are for some reason considered more newsworthy. Maybe because once they get access to your VPS via them, the rest is even more trivial.