4 ms·

Something about this doesn't bother me as much as other side channels. To me, this reads like trying to predict the presence, make, model & operational schedul

Something about this doesn't bother me as much as other side channels. To me, this reads like trying to predict the presence, make, model & operational schedule of someone's washing machine just by observing how fast their power meter spins over time. Unless you have an intimate awareness of all of the other power consuming appliances, as well as habits of the homeowner, you would have a hell of a time reaching any meaningful conclusions.

laurent123456 4y ago
I guess it's a problem when it's possible to isolate a particular cryptographic operation? For example on a server that's not particularly busy.
JulianWasTaken 4y ago
I would claim to know less than nothing about what's happening here, but to press a bit on the analogy -- aren't there workloads where clearly you're going to be more sure about what's happening? E.g. consider a bastion host proxying SSH connections into an environment. If you can observe the power meter on that laundry machine, you're much more likely to know what's using the power, no? (Especially so if the bastion isn't used flatly throughout the day).
- IncRnd 4y ago
  Often, these side channel attacks work using an oracle or by forcing the system into a vulnerable state. Forcing a cpu to scale frequencies would do that here.
kzrdude 4y ago
You can say the same thing about all of these attacks. That they are tedious ways of collecting data. The problem is that computers can be made to repeat operations, over and over again. Leaking keys fractional bit by bit or what it is. That's why the attack doesn't work against someone's laundry machine - unless it's connected to the internet, that is.
- velcrovan 4y ago
  This is the kind of exploit that might legitimately warrant the character-by-character “password slot machine” animation from movies like “War Games” (https://tvtropes.org/pmwiki/pmwiki.php/Main/PasswordSlotMachine https://tvtropes.org/pmwiki/pmwiki.php/Main/PasswordSlotMach...)
  - coredog64 4y ago
    If a string match isn’t done in constant time you could theoretically get your results character by character. (Top of mind because I just had to handle that case in a GH webhook)
  - nmilo 4y ago
    Careful, you might lose an hour on that site.
mike_hock 4y ago
> To me, this reads like trying to predict the presence, make, model & operational schedule of someone's washing machine just by observing how fast their power meter spins over time. That sounds almost trivially easy provided you can afford to buy each and every washing machine on the market so you can measure its power consumption profile for each of its programs.
_yb2s 4y ago
> predict the presence, make, model & operational schedule of someone's washing machine just by observing how fast their power meter spins over time I think this is a really excellent analogy that explains the situation well. However, I think doing exactly that would be really straightforward, and your analogy explains why. Imagine an ML model constantly adjusting the probabilities for the set of possible washing machines... after a large number of washing machine runs, it will be narrowed down to a really small subset of the possibilities. Given that this is a cryptographic key, they can then trivially brute force the remaining possibilities.
samus 4y ago
It's more like being able to tell what else is in the washing machine after I hand you some pants to wash for me.
R0b0t1 4y ago
It's more like discerning the washing machine based on the power meter, but you know exactly when and how many washing machines turn various bits on and off. Could be doable, with some expensive equipment. For the ghost side channel attacks we did see in situ proofs of concept. It's an open question how many people have the skill to do either those side channel exploits or the power meter washing machine guess above and are also engaged in crime.

laurent123456 4y ago

I guess it's a problem when it's possible to isolate a particular cryptographic operation? For example on a server that's not particularly busy.

JulianWasTaken 4y ago

I would claim to know less than nothing about what's happening here, but to press a bit on the analogy -- aren't there workloads where clearly you're going to be more sure about what's happening? E.g. consider a bastion host proxying SSH connections into an environment. If you can observe the power meter on that laundry machine, you're much more likely to know what's using the power, no? (Especially so if the bastion isn't used flatly throughout the day).

IncRnd 4y ago
Often, these side channel attacks work using an oracle or by forcing the system into a vulnerable state. Forcing a cpu to scale frequencies would do that here.

kzrdude 4y ago

You can say the same thing about all of these attacks. That they are tedious ways of collecting data. The problem is that computers can be made to repeat operations, over and over again. Leaking keys fractional bit by bit or what it is. That's why the attack doesn't work against someone's laundry machine - unless it's connected to the internet, that is.

velcrovan 4y ago
This is the kind of exploit that might legitimately warrant the character-by-character “password slot machine” animation from movies like “War Games” (https://tvtropes.org/pmwiki/pmwiki.php/Main/PasswordSlotMachine https://tvtropes.org/pmwiki/pmwiki.php/Main/PasswordSlotMach...)
- coredog64 4y ago
  If a string match isn’t done in constant time you could theoretically get your results character by character. (Top of mind because I just had to handle that case in a GH webhook)
- nmilo 4y ago
  Careful, you might lose an hour on that site.

mike_hock 4y ago

> To me, this reads like trying to predict the presence, make, model & operational schedule of someone's washing machine just by observing how fast their power meter spins over time. That sounds almost trivially easy provided you can afford to buy each and every washing machine on the market so you can measure its power consumption profile for each of its programs.

_yb2s 4y ago

> predict the presence, make, model & operational schedule of someone's washing machine just by observing how fast their power meter spins over time I think this is a really excellent analogy that explains the situation well. However, I think doing exactly that would be really straightforward, and your analogy explains why. Imagine an ML model constantly adjusting the probabilities for the set of possible washing machines... after a large number of washing machine runs, it will be narrowed down to a really small subset of the possibilities. Given that this is a cryptographic key, they can then trivially brute force the remaining possibilities.

samus 4y ago

It's more like being able to tell what else is in the washing machine after I hand you some pants to wash for me.

R0b0t1 4y ago

It's more like discerning the washing machine based on the power meter, but you know exactly when and how many washing machines turn various bits on and off. Could be doable, with some expensive equipment. For the ghost side channel attacks we did see in situ proofs of concept. It's an open question how many people have the skill to do either those side channel exploits or the power meter washing machine guess above and are also engaged in crime.