7 ms·

It's not just YubiKey. NinjaLab: "All Infineon security microcontrollers (including TPMs) that run the Infineon cryptographic library (as far as we know, any e

It's not just YubiKey. NinjaLab: "All Infineon security microcontrollers (including TPMs) that run the Infineon cryptographic library (as far as we know, any existing version) are vulnerable to the attack." - Chips in e-passports from the US, China, India, Brazil and numerous European and Asian nations - Secure enclaves in Samsung and OnePlus phones - Cryptocurrency hardware wallets like Ledger and Trezor - SIM cards - TPMs in laptops from Lenovo, Dell, and HP - EMV chips in credit and debit cards

madars 2y ago
Ledger uses STMicroelectronics secure elements and should not be affected by this. Trezor Safe uses Infineon OPTIGA though. See https://bitcointalk.org/index.php?topic=5304483.0 https://bitcointalk.org/index.php?topic=5304483.0 for a table with wallets and their respective microcontrollers/secure elements.
- notarealllama 2y ago
  Nice to see a fellow enthusiast here, this is a nice point that different hardware will have different levels of related risk. But this is kind of an entire class of attack where similar paths may be able to be used on these other controllers. Don't gloss over it. On a side note, used to frequent a bar where one of the creators of Ledger also did. Was nice to spend various crypto freely!
  - rfoo 2y ago
    This is an entire class of attacks known since almost forever. So yeah, some of us already considered this so we'd like to gross over it this time.
- pshirshov 2y ago
  Ledger literally supports key extraction as a feature and pushes hard the firmware updates. Last S firmware w/o key extraction still works, while the same X version cannot be used anymore.
TacticalCoder 2y ago
> - Cryptocurrency hardware wallets like Ledger and Trezor Ledger hardware wallets (which btw can serve as U2F authentication but, AFAIK, not FIDO2) are protected by a PIN: three wrong PINs and the device, unlike a Yubikey, factory resets itself. IIUC the side-channel attack relies on a non constant-time modinv. I don't know if there's a way to force that modinv to happen on a Ledger without knowing the PIN. I take it we'll have a writeup by Ledger on that attack very soon.
- Xylakant 2y ago
  Yubikeys don’t use a pin by default, but at least the ones I use all have the option to set one.
  - lxgr 2y ago
    Whether a PIN is used is determined by the RP on a per-authentication basis, so unfortunately this attack likely breaks that mechanism.
    - traceroute66 2y ago
      > Whether a PIN is used is determined by the RP on a per-authentication basis Ahem, cough... ykman fido config toggle-always-uv
      - lxgr 2y ago
        Does that work for Yubikeys other than the Yubikey Bio?
        lxgr 2y ago
        I just tried it on a 5C NFC (firmware 5.4.3) and got: ERROR: Always Require UV is not supported on this YubiKey. So I'm really not sure this is an option for non-Bio keys, unless it was introduced quite recently.
- deleted 2y ago
hadlock 2y ago
Passports are kind of a big deal. The customs agent is going to visually verify the photo vs the holder, but the customs agent is going to trust the valid RFID chip probably 100% of the time as it's assumed to be unbreakable.
- baybal2 2y ago
  [dead]
- lxgr 2y ago
  I'd be surprised if the chip even gets activated in 50% of all validations, to be honest.
  - DANmode 2y ago
    All globally? Less than 10.
    - wongarsu 2y ago
      However if we look only at border checkpoints (including airports) in first world nations the number is probably a lot higher. Not only are agents likely to be using the chip, self-service immigration gates have become really popular at airports around the world and mostly use the RFID chip together with a face scan
      - stingraycharles 2y ago
        So what would an attack of the RFID chip look like, if the person still is facially identified using a face scan?
        notpushkin 2y ago
        1. Obtain a donor passport, get the chip, dump the Active Authentication key which is used to ensure you can't clone the chip 2. Make a fake passport with your photo (and fingerprints etc.) and add the AA key so that it passes the check You'll still have to somehow fake Passive Authentication (in which your data, including photo, is signed by the country's public key) too, though.
trebligdivad 2y ago
Yeh, it's a bingo list of the news stories to watch out for. I guess some restricted/critical/secret infrastructure stuff as well.
cotillion 2y ago
Infineon chips are used in some smart tachographs in EU. This is likely to get very messy. Extract those keys and your drivers can ignore all annoying work-time rules and you can just patch the files if you are audited.
- PinguTS 2y ago
  Not really, as it is an expansive procedure which needs to be done on every single device. Very unlikely that this will be done.
lxgr 2y ago
Fortunately (in this case) the payments card industry only acknowledged the existence of Elliptic Curves in 2021 [1], so most EMV cards should be safe. The most important parts use symmetric keys anyway. [1] https://www.emvco.com/knowledge-hub/emv-chip-specifications-to-support-elliptic-curve-cryptography/ https://www.emvco.com/knowledge-hub/emv-chip-specifications-...
- xeyownt 2y ago
  The attack is on elliptic curves...
mirages 2y ago
This is at best another forensic tool (unlocking the TPM of a locked laptop/phone for prosecution) and at worst a red herring for security flag. - Clone a passport -> why cloning if you can issue new ones - getting risked being detected while using a clone (2 entries in 2 different countries, and you also need to look like the person) not to mention you have to destroy the passport - Phone enclaves -> see above - Crypto -> Hardware wallets should be kept on eye as badly as your normal wallet - SIM Cards -> Swapping is faster, or if you're the the gov, just an intercept warrant will do the trick - Laptops -> see above - EMV Chips -> If you have those skills and money, I don't think you'll lose time on cloning credit/debit cards
- mschuster91 2y ago
  > - Clone a passport -> why cloning if you can issue new ones - getting risked being detected while using a clone (2 entries in 2 different countries, and you also need to look like the person) not to mention you have to destroy the passport Well... not really. ICAO compliant passports do not require storing a photo embedded in the chip, as long as you can forge the physical part of the passport (or obtain blanks) you just need the digital certificates from a "donor" passport of John Doe, print "John Doe" and his personal data (birth day/place, nationality, issuance/expiry data) on the human readable and MRZ fields, but crucially the photo of the person using the forgery. Also, there are no centralized, cross country stores of entry/departure. Lots of places don't even register it for visa-free border crossings. Some national ID documents, e.g. the Croatian national ID card "osobna iskaznica", do store a photo embedded in the chip, so that indeed restricts a forgery from being used by a non-lookalike.
  - lxgr 2y ago
    > ICAO compliant passports do not require storing a photo embedded in the chip That's completely on the issuing country then, though, just like they e.g. might choose to not use dynamic chip authentication, which also makes the passport subject to trivial chip cloning. I wouldn't be surprised if some e-border gates reject travel documents that don't support chip authentication or don't have a digital version of the photo covered by the issuer signature.
crossroadsguy 2y ago
> Chips in e-passports from the US, China, India India has e-passports? I am from there and I have one I renewed during the pandemic, so might have missed the news, but I didn't know we have e-passports now. I tried googling and didn't find much (the official page doesn't load). https://passportindia.gov.in/AppOnlineProject/online/faqEPassport https://passportindia.gov.in/AppOnlineProject/online/faqEPas... Also I checked the PDF on Ninjalab port (article linked in this post) and there was no mention of India there. Is it from some other source like Twitter?
- panarky 2y ago
  India's e-passports https://passportindia.gov.in/AppOnlineProject/online/faqEPassport https://passportindia.gov.in/AppOnlineProject/online/faqEPas... They use Infineon chips https://www.securetechalliance.org/infineon-ships-security-chips-to-taiwans-electronic-passport-program/ https://www.securetechalliance.org/infineon-ships-security-c...
morpheuskafka 2y ago
If I remember correctly, Infineon already had a big TPM recall a while back. I remember my T470p had to first install a BIOS update to enable userspace updating of the TPM, then the TPM update itself. And I think some Yubikeys were replaced for free due to the same or similar issue.
natpalmer1776 2y ago
Sounds like they buried the lede with this one then. Some of the items on that list being 'crackable' seem infinitely more dangerous than a general-purpose device such as a YubiKey.
numpad0 2y ago
Aren't EMV and secure enclaves big deals?

madars 2y ago

Ledger uses STMicroelectronics secure elements and should not be affected by this. Trezor Safe uses Infineon OPTIGA though. See https://bitcointalk.org/index.php?topic=5304483.0 https://bitcointalk.org/index.php?topic=5304483.0 for a table with wallets and their respective microcontrollers/secure elements.

notarealllama 2y ago
Nice to see a fellow enthusiast here, this is a nice point that different hardware will have different levels of related risk. But this is kind of an entire class of attack where similar paths may be able to be used on these other controllers. Don't gloss over it. On a side note, used to frequent a bar where one of the creators of Ledger also did. Was nice to spend various crypto freely!
- rfoo 2y ago
  This is an entire class of attacks known since almost forever. So yeah, some of us already considered this so we'd like to gross over it this time.
pshirshov 2y ago
Ledger literally supports key extraction as a feature and pushes hard the firmware updates. Last S firmware w/o key extraction still works, while the same X version cannot be used anymore.

TacticalCoder 2y ago

> - Cryptocurrency hardware wallets like Ledger and Trezor Ledger hardware wallets (which btw can serve as U2F authentication but, AFAIK, not FIDO2) are protected by a PIN: three wrong PINs and the device, unlike a Yubikey, factory resets itself. IIUC the side-channel attack relies on a non constant-time modinv. I don't know if there's a way to force that modinv to happen on a Ledger without knowing the PIN. I take it we'll have a writeup by Ledger on that attack very soon.

Xylakant 2y ago
Yubikeys don’t use a pin by default, but at least the ones I use all have the option to set one.
- lxgr 2y ago
  Whether a PIN is used is determined by the RP on a per-authentication basis, so unfortunately this attack likely breaks that mechanism.
  - traceroute66 2y ago
    > Whether a PIN is used is determined by the RP on a per-authentication basis Ahem, cough... ykman fido config toggle-always-uv
    - lxgr 2y ago
      Does that work for Yubikeys other than the Yubikey Bio?
      - lxgr 2y ago
        I just tried it on a 5C NFC (firmware 5.4.3) and got: ERROR: Always Require UV is not supported on this YubiKey. So I'm really not sure this is an option for non-Bio keys, unless it was introduced quite recently.
deleted 2y ago

hadlock 2y ago

Passports are kind of a big deal. The customs agent is going to visually verify the photo vs the holder, but the customs agent is going to trust the valid RFID chip probably 100% of the time as it's assumed to be unbreakable.

baybal2 2y ago
[dead]
lxgr 2y ago
I'd be surprised if the chip even gets activated in 50% of all validations, to be honest.
- DANmode 2y ago
  All globally? Less than 10.
  - wongarsu 2y ago
    However if we look only at border checkpoints (including airports) in first world nations the number is probably a lot higher. Not only are agents likely to be using the chip, self-service immigration gates have become really popular at airports around the world and mostly use the RFID chip together with a face scan
    - stingraycharles 2y ago
      So what would an attack of the RFID chip look like, if the person still is facially identified using a face scan?
      - notpushkin 2y ago
        1. Obtain a donor passport, get the chip, dump the Active Authentication key which is used to ensure you can't clone the chip 2. Make a fake passport with your photo (and fingerprints etc.) and add the AA key so that it passes the check You'll still have to somehow fake Passive Authentication (in which your data, including photo, is signed by the country's public key) too, though.

trebligdivad 2y ago

Yeh, it's a bingo list of the news stories to watch out for. I guess some restricted/critical/secret infrastructure stuff as well.

cotillion 2y ago

Infineon chips are used in some smart tachographs in EU. This is likely to get very messy. Extract those keys and your drivers can ignore all annoying work-time rules and you can just patch the files if you are audited.

PinguTS 2y ago
Not really, as it is an expansive procedure which needs to be done on every single device. Very unlikely that this will be done.

lxgr 2y ago

Fortunately (in this case) the payments card industry only acknowledged the existence of Elliptic Curves in 2021 [1], so most EMV cards should be safe. The most important parts use symmetric keys anyway. [1] https://www.emvco.com/knowledge-hub/emv-chip-specifications-to-support-elliptic-curve-cryptography/ https://www.emvco.com/knowledge-hub/emv-chip-specifications-...

xeyownt 2y ago
The attack is on elliptic curves...

mirages 2y ago

This is at best another forensic tool (unlocking the TPM of a locked laptop/phone for prosecution) and at worst a red herring for security flag. - Clone a passport -> why cloning if you can issue new ones - getting risked being detected while using a clone (2 entries in 2 different countries, and you also need to look like the person) not to mention you have to destroy the passport - Phone enclaves -> see above - Crypto -> Hardware wallets should be kept on eye as badly as your normal wallet - SIM Cards -> Swapping is faster, or if you're the the gov, just an intercept warrant will do the trick - Laptops -> see above - EMV Chips -> If you have those skills and money, I don't think you'll lose time on cloning credit/debit cards

mschuster91 2y ago
> - Clone a passport -> why cloning if you can issue new ones - getting risked being detected while using a clone (2 entries in 2 different countries, and you also need to look like the person) not to mention you have to destroy the passport Well... not really. ICAO compliant passports do not require storing a photo embedded in the chip, as long as you can forge the physical part of the passport (or obtain blanks) you just need the digital certificates from a "donor" passport of John Doe, print "John Doe" and his personal data (birth day/place, nationality, issuance/expiry data) on the human readable and MRZ fields, but crucially the photo of the person using the forgery. Also, there are no centralized, cross country stores of entry/departure. Lots of places don't even register it for visa-free border crossings. Some national ID documents, e.g. the Croatian national ID card "osobna iskaznica", do store a photo embedded in the chip, so that indeed restricts a forgery from being used by a non-lookalike.
- lxgr 2y ago
  > ICAO compliant passports do not require storing a photo embedded in the chip That's completely on the issuing country then, though, just like they e.g. might choose to not use dynamic chip authentication, which also makes the passport subject to trivial chip cloning. I wouldn't be surprised if some e-border gates reject travel documents that don't support chip authentication or don't have a digital version of the photo covered by the issuer signature.

crossroadsguy 2y ago

> Chips in e-passports from the US, China, India India has e-passports? I am from there and I have one I renewed during the pandemic, so might have missed the news, but I didn't know we have e-passports now. I tried googling and didn't find much (the official page doesn't load). https://passportindia.gov.in/AppOnlineProject/online/faqEPassport https://passportindia.gov.in/AppOnlineProject/online/faqEPas... Also I checked the PDF on Ninjalab port (article linked in this post) and there was no mention of India there. Is it from some other source like Twitter?

panarky 2y ago
India's e-passports https://passportindia.gov.in/AppOnlineProject/online/faqEPassport https://passportindia.gov.in/AppOnlineProject/online/faqEPas... They use Infineon chips https://www.securetechalliance.org/infineon-ships-security-chips-to-taiwans-electronic-passport-program/ https://www.securetechalliance.org/infineon-ships-security-c...

morpheuskafka 2y ago

If I remember correctly, Infineon already had a big TPM recall a while back. I remember my T470p had to first install a BIOS update to enable userspace updating of the TPM, then the TPM update itself. And I think some Yubikeys were replaced for free due to the same or similar issue.

natpalmer1776 2y ago

Sounds like they buried the lede with this one then. Some of the items on that list being 'crackable' seem infinitely more dangerous than a general-purpose device such as a YubiKey.

numpad0 2y ago

Aren't EMV and secure enclaves big deals?