Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Simple demo of a cold boot attack using a Raspberry Pi

github.com

Post reply on HN
Print view View original

31–40 of 40 posts

Re: Show HN: Simple demo of a cold boot attack using a Raspberry Pi

#31

Post by jacquesm »

anfractuosity wrote: post #13
yonatan8070 wrote: post #11

Earlier quoted context omitted.

What results would you expect to get if you simply put the whole setup in a regular freezer? Or if you just tried it during winter

It sounds like a typical freezer cools to around -20C, I think the freezer spray I used directly on DDR chip, claims to chill to around -50C, but not sure how much the surface temperature decreases after spraying and how fast it warms up again.

Industrial freezers will go to -45, lab freezers to -85 before getting into really exotic stuff.

Re: Show HN: Simple demo of a cold boot attack using a Raspberry Pi

#32

Post by krab »

Cheer2171 wrote: post #23
orlp wrote: post #20

Earlier quoted context omitted.

Alright let's test this hypothesis. Load up a bitcoin wallet and post the private key here with 1 random bit flip :)

You might think you're being clever, but specifying exactly 1 random bit flip makes it a completely different scenario.

If you can reliably find the key in memory, even if it's partially damaged, it may practically possible to recover it. You can try keys sorted by edit distance from the recovered material. Maybe there are better methods taking into account the actual cryptography.

Re: Show HN: Simple demo of a cold boot attack using a Raspberry Pi

#33

Post by ivancho »

Cheer2171 wrote: post #23
orlp wrote: post #20

Earlier quoted context omitted.

Alright let's test this hypothesis. Load up a bitcoin wallet and post the private key here with 1 random bit flip :)

You might think you're being clever, but specifying exactly 1 random bit flip makes it a completely different scenario.

The original comment said "One bit flip and it's game over". Which is clear nonsense, I don't have to specify that there's exactly one bit flip, I just need to know that the key is in that general neighborhood and its security is already compromised.

Re: Show HN: Simple demo of a cold boot attack using a Raspberry Pi

#34

Post by ivancho »

matheusmoreira wrote: post #30
orlp wrote: post #20

Earlier quoted context omitted.

Alright let's test this hypothesis. Load up a bitcoin wallet and post the private key here with 1 random bit flip :)

If you just recovered a secret key, you have no idea how many bits were flipped or their positions or if they were flipped at all or even it if it's actually a key rather than random garbage data. Key strength is therefore maintained. Posting a secret key here and specifying "exactly one bit was flipped" reduces the problem to N guesses where N is the key length since you know all the other N - 1 bits are correct. Le…

You can't simultaneously have that key strength is maintained as long as they don't know how many bits are flipped, or where in memory the key was, but also that leaking any number of bits is catastrophic. If your memory dump creates a different distribution on the space of possible keys, it has already compromised the cryptographic security of the key, it's just a question of how much, and the answer here is a lot - even if we had GBs of garbage data, that is still tiny compared to the whole space and can be sifted extremely quickly

Re: Show HN: Simple demo of a cold boot attack using a Raspberry Pi

#35

Post by azalemeth »

jacquesm wrote: post #31
anfractuosity wrote: post #13

Earlier quoted context omitted.

It sounds like a typical freezer cools to around -20C, I think the freezer spray I used directly on DDR chip, claims to chill to around -50C, but not sure how much the surface temperature decreases after spraying and how fast it warms up again.

Industrial freezers will go to -45, lab freezers to -85 before getting into really exotic stuff.

LN2 is 77 K (-196 ºc) and dirt cheap -- cents/pence per litre. Most electronics works surprisingly well in it, at least until it warms up and the condensation starts to be a problem ;-).

Re: Show HN: Simple demo of a cold boot attack using a Raspberry Pi

#36

Post by matheusmoreira »

ivancho wrote: post #34
matheusmoreira wrote: post #30

Earlier quoted context omitted.

If you just recovered a secret key, you have no idea how many bits were flipped or their positions or if they were flipped at all or even it if it's actually a key rather than random garbage data. Key strength is therefore maintained. Posting a secret key here and specifying "exactly one bit was flipped" reduces the problem to N guesses where N is the key length since you know all the other N - 1 bits are correct. Le…

You can't simultaneously have that key strength is maintained as long as they don't know how many bits are flipped, or where in memory the key was, but also that leaking any number of bits is catastrophic. If your memory dump creates a different distribution on the space of possible keys, it has already compromised the cryptographic security of the key, it's just a question of how much, and the answer here is a lot -…

> If your memory dump creates a different distribution on the space of possible keys

Is it possible to determine that this has happened though? If you're trying to recover an image and a bunch of bits are flipped, the result might be somewhat corrupted but a coherent image will still be visible. You know that the data was corrupted and where the damage is. Ciphers have avalanche effects, a single bit flip produces completely unusable output which by design reveals no information.

Re: Show HN: Simple demo of a cold boot attack using a Raspberry Pi

#37

Post by ivancho »

matheusmoreira wrote: post #36
ivancho wrote: post #34

Earlier quoted context omitted.

You can't simultaneously have that key strength is maintained as long as they don't know how many bits are flipped, or where in memory the key was, but also that leaking any number of bits is catastrophic. If your memory dump creates a different distribution on the space of possible keys, it has already compromised the cryptographic security of the key, it's just a question of how much, and the answer here is a lot -…

> If your memory dump creates a different distribution on the space of possible keys Is it possible to determine that this has happened though? If you're trying to recover an image and a bunch of bits are flipped, the result might be somewhat corrupted but a coherent image will still be visible. You know that the data was corrupted and where the damage is. Ciphers have avalanche effects, a single bit flip produces co…

There is extensive research on key finding attacks. Often they only need 30% of the bits. Things can be sped up by exploiting entropy - keys are really random, unlike most of the rest of your memory, so that filters things down, and as you said, an incorrect key produces total garbage on decrypt, which is easy to detect, so you can automate testing and discarding key candidates. Lastly, if you have knowledge of the applications or algorithms involved, you often get some extra data structure around the keys, which makes searching the memory dump trivial.

All that is to say, yes, this is a viable attack vector, even if some or many of the bits are flipped

Re: Show HN: Simple demo of a cold boot attack using a Raspberry Pi

#38

Post by matheusmoreira »

ivancho wrote: post #37
matheusmoreira wrote: post #36

Earlier quoted context omitted.

> If your memory dump creates a different distribution on the space of possible keys Is it possible to determine that this has happened though? If you're trying to recover an image and a bunch of bits are flipped, the result might be somewhat corrupted but a coherent image will still be visible. You know that the data was corrupted and where the damage is. Ciphers have avalanche effects, a single bit flip produces co…

There is extensive research on key finding attacks. Often they only need 30% of the bits. Things can be sped up by exploiting entropy - keys are really random, unlike most of the rest of your memory, so that filters things down, and as you said, an incorrect key produces total garbage on decrypt, which is easy to detect, so you can automate testing and discarding key candidates. Lastly, if you have knowledge of the a…

I see. Then I was wrong when I said key strength was maintained due to unfounded assumptions.

Re: Show HN: Simple demo of a cold boot attack using a Raspberry Pi

#39

Post by TeMPOraL »

azalemeth wrote: post #35
jacquesm wrote: post #31

Earlier quoted context omitted.

Industrial freezers will go to -45, lab freezers to -85 before getting into really exotic stuff.

LN2 is 77 K (-196 ºc) and dirt cheap -- cents/pence per litre. Most electronics works surprisingly well in it, at least until it warms up and the condensation starts to be a problem ;-).

What about the material physics of losing some 220°C in a second? Won't things crack from this alone?

Re: Show HN: Simple demo of a cold boot attack using a Raspberry Pi

#40

Post by azalemeth »

TeMPOraL wrote: post #39
azalemeth wrote: post #35

Earlier quoted context omitted.

LN2 is 77 K (-196 ºc) and dirt cheap -- cents/pence per litre. Most electronics works surprisingly well in it, at least until it warms up and the condensation starts to be a problem ;-).

What about the material physics of losing some 220°C in a second? Won't things crack from this alone?

That's an excellent question and as you rightly highlight depends on things like ∂T/∂t that are perhaps a bit harder to control

In practice, however, most electronics is fine (!) with the right materials – even a relatively bog-standard gaming CPU [1]...

[1] https://www.youtube.com/results?search_query=ln2+overclockin...

Post reply on HN