3 ms·
didn't PS3 have a hardcoded nonce for their ECDSA impl that allowed full key recovery? I would agree that I doubt LLMs let people mount side-channel attacks eas
by mswphd 6mo ago
didn't PS3 have a hardcoded nonce for their ECDSA impl that allowed full key recovery? I would agree that I doubt LLMs let people mount side-channel attacks easily on consumer electronics though.
- throwaway89201 6mo agoYes indeed, that chain of exploits was all software and not hardware. Developed after the Hotz exploit and Sony subsequently shuttering OtherOS. It didn't directly give access to anything however. IIRC they heavily relied on other complex exploits they developed themselves, as well as relying on earlier exploits they could access by rolling back the firmware by indeed abusing the ECDSA implementation. At least, that turned out to be the path of least resistance. Without earlier exploits, there would be less known about the system to work with. Their presentation [1] [2] is still a very interesting watch. [1] https://www.youtube.com/watch?v=5E0DkoQjCmI https://www.youtube.com/watch?v=5E0DkoQjCmI [2] https://fahrplan.events.ccc.de/congress/2010/Fahrplan/attachments/1780_27c3_console_hacking_2010.pdf https://fahrplan.events.ccc.de/congress/2010/Fahrplan/attach...
- throwaway89201 6mo ago^-- ignore much of the IIRC above; I completely misremembered, I now notice after rewatching the talk.