ECDSA Key Extraction from Mobile Devices via Nonintrusive Physical Side Channels
1–10 of 56 posts
Re: ECDSA Key Extraction from Mobile Devices via Nonintrusive Physical Side Channels
#2From the abstract "We show that elliptic-curve cryptography implementations on mobile devices are vulnerable to electromagnetic and power side-channel attacks. We demonstrate full extraction of ECDSA secret signing keys from OpenSSL and CoreBitcoin running on iOS devices, and partial key leakage from OpenSSL running on Android and from iOS's CommonCrypto. These non-intrusive attacks use a simple magnetic probe placed in proximity to the device, or a power probe on the phone's USB cable. They use a bandwidth of merely a few hundred kHz, and can be performed cheaply using an audio card and an improvised magnetic probe".
Re: ECDSA Key Extraction from Mobile Devices via Nonintrusive Physical Side Channels
#3What sorcery is this?!
Re: ECDSA Key Extraction from Mobile Devices via Nonintrusive Physical Side Channels
#4Side-Channel attacks are nasty. Wonder why the FBI wasn't able to use this to hack the San Bernardino iPhone 5C, the NSA must be aware of this? From the article
In the sequel, unless stated otherwise, the experiments were performed on Apple iPhone 3GS which exhibited a particularly clear signal.
Hope Apple fixes this in future models, even when opened.
Re: ECDSA Key Extraction from Mobile Devices via Nonintrusive Physical Side Channels
#5Side-Channel attacks are nasty. Wonder why the FBI wasn't able to use this to hack the San Bernardino iPhone 5C, the NSA must be aware of this? From the article In the sequel, unless stated otherwise, the experiments were performed on Apple iPhone 3GS which exhibited a particularly clear signal. Hope Apple fixes this in future models, even when opened.
iOS 9, which apparently isn't vulnerable to this, was released 3 months prior to the San Bernardino attack. Furthermore, is a locked phone just sitting there performing time-dependent ECDSA signing operations all day long?
Re: ECDSA Key Extraction from Mobile Devices via Nonintrusive Physical Side Channels
#6It's great to see this kind of work published. It is worth noting however that the US government is well aware of these kind of attacks. The Snowdon docs show that the CIA have been performing side-channel analysis since 2012 on the Iphone 4s and Ipad 2: https://theintercept.com/2015/03/10/ispy-cia-campaign-steal-...
Cryptography Research demonstrated this on an ipod in 2011: https://www.youtube.com/watch?v=4L8rnYhnLt8
In any case, great stuff.
Re: ECDSA Key Extraction from Mobile Devices via Nonintrusive Physical Side Channels
#7This paper seems to focus on old Apple hardware (the newest I can find is the iPhone 5s). I wonder what the results would be on Apple's newest hardware (6 and above).
Re: ECDSA Key Extraction from Mobile Devices via Nonintrusive Physical Side Channels
#8This is a really impressive piece of work. Unfortunately, the authors completely ignore Curve25519[0], which was designed by DJB (and implemented as NaCl[1]), with the goal to reduce side-channel vulnerabilities.
From a random Curve25519 presentation [2]:
- No data-dependent branches.
- No data-dependent indexing.
I really wonder how much can be extracted from a NaCl implementation under the same conditions.
Re: ECDSA Key Extraction from Mobile Devices via Nonintrusive Physical Side Channels
#9Side-Channel attacks are nasty. Wonder why the FBI wasn't able to use this to hack the San Bernardino iPhone 5C, the NSA must be aware of this? From the article In the sequel, unless stated otherwise, the experiments were performed on Apple iPhone 3GS which exhibited a particularly clear signal. Hope Apple fixes this in future models, even when opened.
San Bernardino 5C could be cracked in two days using a NAND flash write blocker. You only need to program an FPGA to buffer writes to NAND chips in RAM instead of passing them through and to allow the reads, then you just try N PIN codes and reboot while resetting the blocker state cache. N is 4 if they haven't tried any PINs and 1 if there are delays after each because they've tried a couple PINs already. Phone boot time is ~1 minute, T(10000) = 10000 minutes / N (= a week if N==1)
Re: ECDSA Key Extraction from Mobile Devices via Nonintrusive Physical Side Channels
#10Oh if only there were a elliptic curve digital signature algorithm that was side-channel resistant and well studied by cryptography experts.
https://en.wikipedia.org/wiki/EdDSA
(Fortunately, we should see its adoption when TLS 1.3 is standardized.)