3 ms·

So, if someone has your phone, they have your phone's private RSA key. Jesus.

hobls 8y ago
I’m curious how reliably you could distinguish the act of exponentiaton from other activity if the phone was just sitting on a table. (Or if it was being actively used, but you weren’t able to see what was happening.)
- nielsbot 8y ago
  Any possibility of picking out the pattern of exponentiation activity from a long recording of the device working? ML?
mindslight 8y ago
So, exactly the same as it has always been! What's the point of buying into this model where a possessor (ie owner) of a device is considered an attacker? It hasn't even shown itself to be workable on general-purpose computers, meanwhile users' practical experience seems to be centered around companies that are attempting to hinder people attempting to retain ownership of their phone. Especially as the main push is aimed smaller devices - exactly the ones easier to take with you! At a certain point, the threat from the past (undetectable tampered software) outweighs the threat from the present (due to being able to easily read out the entire device state). It's a bit tough to take a rackmount server into the shower with you, but there's very little reason for a usb-port-sized device to stymie the user for the goal of protecting against physical access.
- xvector 8y ago
  > So, exactly the same as it has always been! Not really. Apple's Secure Enclave is resistant against many side channel attacks, including differential power attacks.
  - mindslight 8y ago
    Sure, but that is a recent development which the jury is still out on. I'm just saying for most all of computing history (besides a few perverted niches), we've thought of the data on the device is accessible by the person who has the device. So this attack just puts us back at the traditional expectation - a place that a large amount of people would actually just prefer to stay.
ams6110 8y ago
Just keep your phone in a wire mesh pouch. Oh wait...
3pt14159 8y ago
I can't remember the exact year, but a while back, maybe 10 years ago, I was talking about this type of attack with some friends, including an EM transmission guy, and we came to the conclusion that it would be hard, but probably possible and it could probably be worked into an airport security scanner. If memory serves, I sent Bruce Schneier an email about it and he replied with: "Very interesting. Thanks." Now that I'm older I realize the hard part would be keeping it secret that you're doing this, not actually pulling it off.

I’m curious how reliably you could distinguish the act of exponentiaton from other activity if the phone was just sitting on a table. (Or if it was being actively used, but you weren’t able to see what was happening.)

nielsbot 8y ago
Any possibility of picking out the pattern of exponentiation activity from a long recording of the device working? ML?

mindslight 8y ago

So, exactly the same as it has always been! What's the point of buying into this model where a possessor (ie owner) of a device is considered an attacker? It hasn't even shown itself to be workable on general-purpose computers, meanwhile users' practical experience seems to be centered around companies that are attempting to hinder people attempting to retain ownership of their phone. Especially as the main push is aimed smaller devices - exactly the ones easier to take with you! At a certain point, the threat from the past (undetectable tampered software) outweighs the threat from the present (due to being able to easily read out the entire device state). It's a bit tough to take a rackmount server into the shower with you, but there's very little reason for a usb-port-sized device to stymie the user for the goal of protecting against physical access.

xvector 8y ago
> So, exactly the same as it has always been! Not really. Apple's Secure Enclave is resistant against many side channel attacks, including differential power attacks.
- mindslight 8y ago
  Sure, but that is a recent development which the jury is still out on. I'm just saying for most all of computing history (besides a few perverted niches), we've thought of the data on the device is accessible by the person who has the device. So this attack just puts us back at the traditional expectation - a place that a large amount of people would actually just prefer to stay.

ams6110 8y ago

Just keep your phone in a wire mesh pouch. Oh wait...

3pt14159 8y ago

I can't remember the exact year, but a while back, maybe 10 years ago, I was talking about this type of attack with some friends, including an EM transmission guy, and we came to the conclusion that it would be hard, but probably possible and it could probably be worked into an airport security scanner. If memory serves, I sent Bruce Schneier an email about it and he replied with: "Very interesting. Thanks." Now that I'm older I realize the hard part would be keeping it secret that you're doing this, not actually pulling it off.