4 ms·

To a cryptographer, that is "quite low". It's not that uncommon to use algorithms where the best known attack takes something like 10 times the lifetime of the

To a cryptographer, that is "quite low". It's not that uncommon to use algorithms where the best known attack takes something like 10 times the lifetime of the universe, assuming every single quark and every tiny bit of energy is used for computation. (A bit of perspective: this is not really a new result, the same group has cracked similar systems before. Smart cards are quite hard to protect from side-channel attacks.)

demallien 15y ago
Yup. It's not about being able to get on Melbourne trains for free, it's about being able to get access to your competitor's research lab, or to their mergers & acquisitions plans, or whatever. In that context, a few hours and a few thousand euros is absolute peanuts. I used to work for a DRM company, and the physical protections designed into those things (not near-field, just standard smartcards) was ludicrous. self-destruction on exposure to light. Measured to ensure that you can't detect good or bad keys by: thermal emissions, electric resistance, electrical consumption, time to respond, and rf emissions. All of that on top of the standard cryptographic requirements makes smartcard design an incredibly challenging proposition, and one that is ultimately futile in my opinion. For example, the last I heard from friends in the biz was that the crackers are still just using agregate measurements, but what happens when they start using high-res thermal imaging? You'll have to make sure that there is no special hotspot (or coldspot) on the chip when decryption succeeds. The same applies to RF emissions. Not easy.
- JoachimSchipper 15y ago
  Yeah. And that's just passive attacks. It gets even scarier when people start creating faults with precisely-timed laser pulses (this equipment is commercially available). Etcetera. Theoretical cryptographers have recently begun studying this kind of problem (in fact, that's what my PhD is about). That may help. Or not. But throwing the problem "over the wall" to the engineers hasn't worked that well, and I hope that some theory can be helpful here.
jcr 15y ago
Joachim, I totally agree with you on the comparison of requirements for power analysis (side channel) attack vectors versus cryptanalysis attack vectors against well vetted algorithms. The difference can be staggering as you mentioned. The issues I take with calling the requirements "quite low" are two fold; (1) Most people could never succeed with this attack vector, and (2) Most people would never bother. This certainly isn't "FireSheep" which really does have "quite low" requirements, and getting free bus passes in San Francisco is certainly not worth the time, expense, and effort, so most people would ever bother to do it. BTW, I've collected some interesting papers and whatnot on side channel attacks. If you want them, email me, but knowing you, you probably already have most of them. ;)
- extension 15y ago
  getting free bus passes in San Francisco is certainly not worth the time, expense, and effort, so most people would ever bother to do it Selling fake bus passes might be worth it though

demallien 15y ago

Yup. It's not about being able to get on Melbourne trains for free, it's about being able to get access to your competitor's research lab, or to their mergers & acquisitions plans, or whatever. In that context, a few hours and a few thousand euros is absolute peanuts. I used to work for a DRM company, and the physical protections designed into those things (not near-field, just standard smartcards) was ludicrous. self-destruction on exposure to light. Measured to ensure that you can't detect good or bad keys by: thermal emissions, electric resistance, electrical consumption, time to respond, and rf emissions. All of that on top of the standard cryptographic requirements makes smartcard design an incredibly challenging proposition, and one that is ultimately futile in my opinion. For example, the last I heard from friends in the biz was that the crackers are still just using agregate measurements, but what happens when they start using high-res thermal imaging? You'll have to make sure that there is no special hotspot (or coldspot) on the chip when decryption succeeds. The same applies to RF emissions. Not easy.

JoachimSchipper 15y ago
Yeah. And that's just passive attacks. It gets even scarier when people start creating faults with precisely-timed laser pulses (this equipment is commercially available). Etcetera. Theoretical cryptographers have recently begun studying this kind of problem (in fact, that's what my PhD is about). That may help. Or not. But throwing the problem "over the wall" to the engineers hasn't worked that well, and I hope that some theory can be helpful here.

jcr 15y ago

Joachim, I totally agree with you on the comparison of requirements for power analysis (side channel) attack vectors versus cryptanalysis attack vectors against well vetted algorithms. The difference can be staggering as you mentioned. The issues I take with calling the requirements "quite low" are two fold; (1) Most people could never succeed with this attack vector, and (2) Most people would never bother. This certainly isn't "FireSheep" which really does have "quite low" requirements, and getting free bus passes in San Francisco is certainly not worth the time, expense, and effort, so most people would ever bother to do it. BTW, I've collected some interesting papers and whatnot on side channel attacks. If you want them, email me, but knowing you, you probably already have most of them. ;)

extension 15y ago
getting free bus passes in San Francisco is certainly not worth the time, expense, and effort, so most people would ever bother to do it Selling fake bus passes might be worth it though