3 ms·

"Are there any known cases of a real-life attacker ever using Spectre, Rowhammer, POODLE, etc?" This is a lot like the Y2K problem, in that nothing particularl

"Are there any known cases of a real-life attacker ever using Spectre, Rowhammer, POODLE, etc?" This is a lot like the Y2K problem, in that nothing particularly bad happened because a lot of people spent a lot of time and money on fixing things. That doesn't mean we shouldn't take them seriously.

hammock 2y ago
Or TSA airport security
JohnKemeny 2y ago
You should include the context: Fancy crypto attack: You have a 0.00001% change of recovering 2 bits of plaintext from a single message Any of the OWASP top ten: You have a 100% chance of recovering the plaintext of all the messages
- Retr0id 2y ago
  It's highly misleading context. Leaking tiny amounts of information a tiny fraction of the time can be totally disastrous in the context of cryptography. One of my favourite recent examples (2020): "LadderLeak: Breaking ECDSA With Less Than One Bit Of Nonce Leakage" https://eprint.iacr.org/2020/615.pdf https://eprint.iacr.org/2020/615.pdf
  - deleted 2y ago
    [deleted]
  - commandersaki 2y ago
    But I think the issue still stands, we keep hearing about timing attacks, spec-ex attacks, partial nonce reveal, etc. and yes you should carefully design around them, but they're pretty much overhyped and there's easier ways to attack systems. The only timing attack that's been seen in the wild is the MAC bypass in XBox 360. The reality is it is too difficult to launch these attacks and the cryptography is rarely attacked unless there's straightforward flaws. As for the partial nonce, I've seen many attacks on this kind of issue, but I've yet to see this mistake made.
    - Retr0id 2y ago
      There aren't many in-the-wild timing attacks because constant-time is table stakes for cryptography implementation, and has been for decades. It's like saying that when driving on a road, the "wheels fall off" risk is overhyped. Wheels falling off may be low on your personal list of concerns, but only because car manufacturers make sure they don't design cars whose wheels fall off. A car with wheels that fall off would be unacceptable. Here's an in-the-wild example of weak nonces being used to compromise Bitcoin wallets: https://research.kudelskisecurity.com/2023/03/06/polynonce-a-tale-of-a-novel-ecdsa-attack-and-bitcoin-tears/ https://research.kudelskisecurity.com/2023/03/06/polynonce-a...
      - commandersaki 2y ago
        > There aren't many in-the-wild timing attacks because constant-time is table stakes for cryptography implementation, and has been for decades. That is one theory and plausible, but another plausible theory is the conditions to setup a timing attack is usually infeasible due to requiring high precision timing, a very large number of samples/measurement, and requiring probes in an ideal situation. AES in software is still a good example of an algorithm where timing attacks are still possible. Take for example djb paper on cache timing [1], it requires 4 million samples before key recovery. The reality is that kind of attack is highly unlikely to occur, and there's been opportunities where non timing safe AES has been used. I'd argue the more pragmatic stance of an attacker is that that timing attacks aren't really practical unless attacking a protection mechanism of a piece of hardware like the Xbox 360, at least for network services it is really low on the list. As for the ECDSA attack, again impressive feat, but only 773 wallets which isn't real cause for concern. I think the bigger concern is using amateur 3rd party implementations of bitcoin that doesn't do nonce generation properly when signing, it really isn't that hard, but I agree it can be a footgun. The reality is this is still a negligible concern compared to real attacks happening everyday draining crypto wallets due to malware threat. [1]: https://cr.yp.to/antiforgery/cachetiming-20050414.pdf https://cr.yp.to/antiforgery/cachetiming-20050414.pdf
        Retr0id 2y ago

hammock 2y ago

Or TSA airport security

JohnKemeny 2y ago

You should include the context: Fancy crypto attack: You have a 0.00001% change of recovering 2 bits of plaintext from a single message Any of the OWASP top ten: You have a 100% chance of recovering the plaintext of all the messages

Retr0id 2y ago
It's highly misleading context. Leaking tiny amounts of information a tiny fraction of the time can be totally disastrous in the context of cryptography. One of my favourite recent examples (2020): "LadderLeak: Breaking ECDSA With Less Than One Bit Of Nonce Leakage" https://eprint.iacr.org/2020/615.pdf https://eprint.iacr.org/2020/615.pdf
- deleted 2y ago
  [deleted]
- commandersaki 2y ago
  But I think the issue still stands, we keep hearing about timing attacks, spec-ex attacks, partial nonce reveal, etc. and yes you should carefully design around them, but they're pretty much overhyped and there's easier ways to attack systems. The only timing attack that's been seen in the wild is the MAC bypass in XBox 360. The reality is it is too difficult to launch these attacks and the cryptography is rarely attacked unless there's straightforward flaws. As for the partial nonce, I've seen many attacks on this kind of issue, but I've yet to see this mistake made.
  - Retr0id 2y ago
    There aren't many in-the-wild timing attacks because constant-time is table stakes for cryptography implementation, and has been for decades. It's like saying that when driving on a road, the "wheels fall off" risk is overhyped. Wheels falling off may be low on your personal list of concerns, but only because car manufacturers make sure they don't design cars whose wheels fall off. A car with wheels that fall off would be unacceptable. Here's an in-the-wild example of weak nonces being used to compromise Bitcoin wallets: https://research.kudelskisecurity.com/2023/03/06/polynonce-a-tale-of-a-novel-ecdsa-attack-and-bitcoin-tears/ https://research.kudelskisecurity.com/2023/03/06/polynonce-a...
    - commandersaki 2y ago
      > There aren't many in-the-wild timing attacks because constant-time is table stakes for cryptography implementation, and has been for decades. That is one theory and plausible, but another plausible theory is the conditions to setup a timing attack is usually infeasible due to requiring high precision timing, a very large number of samples/measurement, and requiring probes in an ideal situation. AES in software is still a good example of an algorithm where timing attacks are still possible. Take for example djb paper on cache timing [1], it requires 4 million samples before key recovery. The reality is that kind of attack is highly unlikely to occur, and there's been opportunities where non timing safe AES has been used. I'd argue the more pragmatic stance of an attacker is that that timing attacks aren't really practical unless attacking a protection mechanism of a piece of hardware like the Xbox 360, at least for network services it is really low on the list. As for the ECDSA attack, again impressive feat, but only 773 wallets which isn't real cause for concern. I think the bigger concern is using amateur 3rd party implementations of bitcoin that doesn't do nonce generation properly when signing, it really isn't that hard, but I agree it can be a footgun. The reality is this is still a negligible concern compared to real attacks happening everyday draining crypto wallets due to malware threat. [1]: https://cr.yp.to/antiforgery/cachetiming-20050414.pdf https://cr.yp.to/antiforgery/cachetiming-20050414.pdf
      - Retr0id 2y ago