5 ms·
It might not be clear from the title without context that the setting for this attack is a local cache-timing attack, which can work cross-VM on the same physic
by schoen 9y ago
It might not be clear from the title without context that the setting for this attack is a local cache-timing attack, which can work cross-VM on the same physical hardware. So if you have an attacker running code on your physical machine, but not necessarily in the same process, account, or VM, you would be vulnerable to private key recovery.
Although the researchers describe mitigations that will dramatically reduce the information leakage, this is further evidence that it's quite dangerous to do software crypto on hardware that may be shared with an adversary.
- userbinator 9y agothis is further evidence that it's quite dangerous to do software crypto on hardware that may be shared with an adversary. I'd generalise and replace "software crypto" with "anything". Especially with things like https://en.wikipedia.org/wiki/Row_hammer https://en.wikipedia.org/wiki/Row_hammer
- burntrelish1273 9y agoIn addition to stress testing (for cooling/overheating and functional testing), we use MemTest86 v7 Free Edition (which does row hammer tests too) on all new computers: desktops, laptops and servers. http://memtest86.com/download.htm#free http://memtest86.com/download.htm#free
- throwanem 9y agoWho is "we"?
- chmod775 9y agoDoes it matter? I trust some guy from a YC startup as much as some random kid fresh out of college. Especially since they usually fit both those shoes. Take stuff like that as a possibly helpful nudge in the right direction, not the one and only truth, regardless of who may have said it.
- throwanem 9y agoThe advice is clearly good. Given the context, it sounds like something that someone at a VPS provider might say, which was what made me curious. In any case, it's relatively rare in my experience here to run across the first-person plural without any antecedent at all, be it ever so vague - which also struck me as curious. I'm not looking to either discount or treat as axiomatic anyone's arguments based on their apparent position along some authority gradient, if that's what you are getting at. What would be the point?
- ivanbakel 9y agoIs there a cheap alternative? I know there are a few vendors selling secure hardware USBs (though how secure I don't know) for various uses, but are there any SoCs to run arbitrary sensitive code without hardware sharing?
- xyzzyz 9y agoIntel SGX provides good isolation, it is still vulnerable to some side channel attacks, though it can be mitigated using a TSX hack. Of course, SGX is not quite available yet on server class CPUs.
- bleair 9y agoThe details aren't completely spelled out here but SGX looks to be an interesting extension of the idea of "virtual machine per block of code" https://software.intel.com/en-us/sgx https://software.intel.com/en-us/sgx It appears a runtime per-site-per-use license is required though.
- amluto 9y agoThe latest SDM strongly suggests that some future CPU will change this. Also, certain Linux x86 developers think that SGX support is vastly more likely to be acceptable upstream if this changes :)
- vitus 9y agoUnfortunately, SGX is also vulnerable to timing attacks that leak the private session key, which breaks the enclave security model. [0] http://www.sharcs-project.eu/m/documents/papers/a02-gotzfried.pdf http://www.sharcs-project.eu/m/documents/papers/a02-gotzfrie...
- femto 9y agoThere are ways to mitigate such attacks at the operating system level, as explored in the following link? https://ts.data61.csiro.au/projects/TS/timingchannels.pml https://ts.data61.csiro.au/projects/TS/timingchannels.pml
- justinjlynn 9y agoThanks heaps for the scope summary. I really do wish papers with such 'scary' titles would clearly indicate how regular users of the software are affected currently and how the security guarantees have been violated for them in the past and under what circumstances. Ideally they'd also say exactly what to do to remedy the problem, at least from the perspective of a user of say libgcrypt/GPG. Doing that would prevent a large amount of needless panic and scrambling.
- Ar-Curunir 9y agoThe people who are in position to fix the issue can extract that information easily from this paper; the paper is targeted towards this audience and academics, not the general populace
- justinjlynn 9y agoand yet, here it is.
- bluejekyll 9y agoAren't they expressly focused on 1024 but keys? It sounds like 2048 doesn't share the same issue yet. Wouldn't your statement imply that we should not be terminating TLS on AWS nodes? Is it even practical these days to not use cloud based, shared hardware? Again, RSA 1024, we've known that's weak for a while now...
- noobermin 9y agoDidn't read the whole paper, but they assert the same is true for 2048 rsa keys, it just requires more computing power, and not an absurd amount more.