3 ms·

It sounds like the keystroke attack they claim isn't practical? > Despite the high recall, with the low precision, we can consider this attack mostly failed or

It sounds like the keystroke attack they claim isn't practical? > Despite the high recall, with the low precision, we can consider this attack mostly failed or severely degraded And in to what I said originally (who is actually doing AES on a GPU?) it sounds like the key recovery is also impractical: > In order to implement a last-round attack, we assume the attacker has access to the victim’s ciphertexts, but not the plaintext or the key. How exactly is a browser supposed to get access to the ciphertext in the first place?

gpm 3y ago
> How exactly is a browser supposed to get access to the ciphertext in the first place? MITM attacks are usually considered relatively easy to pull off. Run a fake wifi-hotspot in an airport, use the "login portal" to get access to their browser, use the hotspot itself to get access to the cipher texts when they visit other https page (edit: I suppose those would be decrypted on the CPU... but when they use whatever odd program that thought decrypting messages to it on the GPU is a good idea).
- bastawhiz 3y ago
  That assumes the encrypted content is transferred in plaintext (not over https). I think you'd be hard pressed to find a HTTPS client that decrypts on the GPU. And then of course, the thing being decrypted needs to be big enough for the process to take long enough for them to perform the attack, which means many gigabytes (terabytes?). And then you'd still need to send the data from the mitm server back to the browser for processing before you start measuring anything. It's obvious they accomplished something, but the scenario they set up simply isn't something that is practical in the real world
  - freeone3000 3y ago
    DRM-encrypted streaming video, perhaps? Gigabytes of encrypted data that needs to be decrypted and displayed?
    - bastawhiz 3y ago
      But you've still got to shuttle that data to the browser and it has to be decrypted on the GPU. I think you'd be hard pressed to find that anywhere in the wild. Modern CPUs can decrypt AES with specialized instructions at a rate that's practically measured in GB/s. Especially for streaming video that doesn't need to decrypt the full stream at once (and where you're probably already using the GPU to, you know, render the video) why would you use the GPU for AES?
redrabbyte 3y ago
Hi, the line about "failed" attacks pertains to the attack on AMD, Nvidia worked fine ;)
- bastawhiz 3y ago
  Even still, it relies on the assumption that you know that the user is typing, and that they're typing something that's interesting to you. You could pop a login page and expect the user to sign in, but it's still a very tenuous scenario to measure what you think might be keypresses. The time to redraw a text box is just as easily the focus ring being drawn, or the submit button being hovered, or a minor scroll event. Even then, the best that I know of for password recovery from timing is "Timing Analysis of Keystrokes and Timing Attacks on SSH", which relies on having data about the user in advance, and they only manage to reduce the search space by about 50x. I'm sure the state of the art is probably a bit better, but that's still assuming a lot: key press timing (that's probably noisy) isn't going to be a meaningful attack vector for arbitrary users online.
  - redrabbyte 3y ago
    concurrent work (https://arxiv.org/ftp/arxiv/papers/2401/2401.04349.pdf https://arxiv.org/ftp/arxiv/papers/2401/2401.04349.pdf) has shown website fingerprinting, recognizing something like the static login page of youtube/google/facebook etc is very much doable. that said, I don't expect to see any of these attacks in the wild. they're primarily demonstrations of the technique and to show that the channel is there as is often the case with side-channel attacks, a serious attacker would much more likely go for un-/recently patched traditional vulnerabilities

gpm 3y ago

> How exactly is a browser supposed to get access to the ciphertext in the first place? MITM attacks are usually considered relatively easy to pull off. Run a fake wifi-hotspot in an airport, use the "login portal" to get access to their browser, use the hotspot itself to get access to the cipher texts when they visit other https page (edit: I suppose those would be decrypted on the CPU... but when they use whatever odd program that thought decrypting messages to it on the GPU is a good idea).

bastawhiz 3y ago
That assumes the encrypted content is transferred in plaintext (not over https). I think you'd be hard pressed to find a HTTPS client that decrypts on the GPU. And then of course, the thing being decrypted needs to be big enough for the process to take long enough for them to perform the attack, which means many gigabytes (terabytes?). And then you'd still need to send the data from the mitm server back to the browser for processing before you start measuring anything. It's obvious they accomplished something, but the scenario they set up simply isn't something that is practical in the real world
- freeone3000 3y ago
  DRM-encrypted streaming video, perhaps? Gigabytes of encrypted data that needs to be decrypted and displayed?
  - bastawhiz 3y ago
    But you've still got to shuttle that data to the browser and it has to be decrypted on the GPU. I think you'd be hard pressed to find that anywhere in the wild. Modern CPUs can decrypt AES with specialized instructions at a rate that's practically measured in GB/s. Especially for streaming video that doesn't need to decrypt the full stream at once (and where you're probably already using the GPU to, you know, render the video) why would you use the GPU for AES?

redrabbyte 3y ago

Hi, the line about "failed" attacks pertains to the attack on AMD, Nvidia worked fine ;)

bastawhiz 3y ago
Even still, it relies on the assumption that you know that the user is typing, and that they're typing something that's interesting to you. You could pop a login page and expect the user to sign in, but it's still a very tenuous scenario to measure what you think might be keypresses. The time to redraw a text box is just as easily the focus ring being drawn, or the submit button being hovered, or a minor scroll event. Even then, the best that I know of for password recovery from timing is "Timing Analysis of Keystrokes and Timing Attacks on SSH", which relies on having data about the user in advance, and they only manage to reduce the search space by about 50x. I'm sure the state of the art is probably a bit better, but that's still assuming a lot: key press timing (that's probably noisy) isn't going to be a meaningful attack vector for arbitrary users online.
- redrabbyte 3y ago
  concurrent work (https://arxiv.org/ftp/arxiv/papers/2401/2401.04349.pdf https://arxiv.org/ftp/arxiv/papers/2401/2401.04349.pdf) has shown website fingerprinting, recognizing something like the static login page of youtube/google/facebook etc is very much doable. that said, I don't expect to see any of these attacks in the wild. they're primarily demonstrations of the technique and to show that the channel is there as is often the case with side-channel attacks, a serious attacker would much more likely go for un-/recently patched traditional vulnerabilities