5 ms·

Anybody can explain to us non-cryptographers if: 1) This is legit? 2) This can work in the real-world and not just in some very specific lab conditions?

mey 16y ago
The first sentence mentions this as a side channel attack, which is a legitimate attack method and applies to most algorithms, not just AES. Most crypto packages guard against this attack one way or another. This is one of the reasons you do not implement your own cryptography solution without understanding all the details, as any weakness can cause a complete compromise. Further reading. http://en.wikipedia.org/wiki/Side_channel_attack http://en.wikipedia.org/wiki/Side_channel_attack Also this article title is slightly mis-leading, but not entirely.
- eru 16y ago
  Side channel attacks can become pretty funny, e.g. listening to the sounds your computer makes.
  - mtigas 16y ago
    In case anyone is wondering (via Wikipedia): In 2004, Adi Shamir and Eran Tromer demonstrated that it may be possible to conduct timing attacks against a CPU performing cryptographic operations by analysis of variations in its humming noise (that is, its high-frequency humming noise, not the louder low-frequency humming of its cooling fan). http://people.csail.mit.edu/tromer/acoustic/ http://people.csail.mit.edu/tromer/acoustic/
  - JoachimSchipper 16y ago
    Some people take long-exposure photographs in a dark box. Yes, really. Of course, electron microscopes and precisely-aimed laser pulses are more... geeky.
js4all 16y ago
2) The attack is possible, but only on the machine which does the encryption. So the threat is real but relatively difficult to exploit. Anyway, the findings are spectacular because most other attacks use time-memory trade-off brute-force methods.
Nrsolis 16y ago
Not only is it legit but it's a kind of attack that is very closely studied because theory != practice. MOST crypto systems fail because they implement a very solid algorithm/protocol in a very bad way. My experience has been that cryptographic systems fail in two ways: 1. Side channel attacks. 2. Key management attacks. There is a whole conference (called CHES) which talks about ways to build/verify crypto hardware that will withstand side channel attacks and prevent the loss of keying material stored in a hardware device. It's a hard problem to get right and a lot of very paranoid people work very hard to anticipate how bad they might be at building a working cryptographic system.
- tptacek 16y ago
  I review roughly 1 cryptosystem per quarter in my practice, have been doing so for several years, and I can't think of a single system that survived as far as "I'd have to mount a side channel attack to break this". If your biggest problem is timing leaks, you win. The stuff that breaks most cryptosystems is much more basic than "side channels" and "key management". It's using ECB mode, encrypting without a MAC, inventing your own SHA1 MAC, leaking errors, colliding IVs or nonces, failure modes that collide session keys, not checking parameters; I could go on and on. I'd hate for people to think that side channels is the thing they have to be on the lookout for. Writing their own crypto constructions is what they need to be on the lookout for.
  - Nrsolis 16y ago
    Point noted. I don't review cryptosystems for a living. I guess my point was that most of the cryptosystems /I've/ used over the years have seen significant vulnerabilities exposed in key management and side channel attacks. Insufficient entropy for key generation is another one. That said, I probably benefit from people like you weeding out the REALLY bad implementations. I do agree that you're likely to see a lot of extraordinarily poorly designed cryptosystems if you regularly look at work product from people who are unfamiliar with attack methodologies in general.
    - tptacek 16y ago

mey 16y ago

The first sentence mentions this as a side channel attack, which is a legitimate attack method and applies to most algorithms, not just AES. Most crypto packages guard against this attack one way or another. This is one of the reasons you do not implement your own cryptography solution without understanding all the details, as any weakness can cause a complete compromise. Further reading. http://en.wikipedia.org/wiki/Side_channel_attack http://en.wikipedia.org/wiki/Side_channel_attack Also this article title is slightly mis-leading, but not entirely.

eru 16y ago
Side channel attacks can become pretty funny, e.g. listening to the sounds your computer makes.
- mtigas 16y ago
  In case anyone is wondering (via Wikipedia): In 2004, Adi Shamir and Eran Tromer demonstrated that it may be possible to conduct timing attacks against a CPU performing cryptographic operations by analysis of variations in its humming noise (that is, its high-frequency humming noise, not the louder low-frequency humming of its cooling fan). http://people.csail.mit.edu/tromer/acoustic/ http://people.csail.mit.edu/tromer/acoustic/
- JoachimSchipper 16y ago
  Some people take long-exposure photographs in a dark box. Yes, really. Of course, electron microscopes and precisely-aimed laser pulses are more... geeky.

js4all 16y ago

2) The attack is possible, but only on the machine which does the encryption. So the threat is real but relatively difficult to exploit. Anyway, the findings are spectacular because most other attacks use time-memory trade-off brute-force methods.

Nrsolis 16y ago

Not only is it legit but it's a kind of attack that is very closely studied because theory != practice. MOST crypto systems fail because they implement a very solid algorithm/protocol in a very bad way. My experience has been that cryptographic systems fail in two ways: 1. Side channel attacks. 2. Key management attacks. There is a whole conference (called CHES) which talks about ways to build/verify crypto hardware that will withstand side channel attacks and prevent the loss of keying material stored in a hardware device. It's a hard problem to get right and a lot of very paranoid people work very hard to anticipate how bad they might be at building a working cryptographic system.

tptacek 16y ago
I review roughly 1 cryptosystem per quarter in my practice, have been doing so for several years, and I can't think of a single system that survived as far as "I'd have to mount a side channel attack to break this". If your biggest problem is timing leaks, you win. The stuff that breaks most cryptosystems is much more basic than "side channels" and "key management". It's using ECB mode, encrypting without a MAC, inventing your own SHA1 MAC, leaking errors, colliding IVs or nonces, failure modes that collide session keys, not checking parameters; I could go on and on. I'd hate for people to think that side channels is the thing they have to be on the lookout for. Writing their own crypto constructions is what they need to be on the lookout for.
- Nrsolis 16y ago
  Point noted. I don't review cryptosystems for a living. I guess my point was that most of the cryptosystems /I've/ used over the years have seen significant vulnerabilities exposed in key management and side channel attacks. Insufficient entropy for key generation is another one. That said, I probably benefit from people like you weeding out the REALLY bad implementations. I do agree that you're likely to see a lot of extraordinarily poorly designed cryptosystems if you regularly look at work product from people who are unfamiliar with attack methodologies in general.
  - tptacek 16y ago