Passive SSH Key Compromise via Lattices [pdf]
eprint.iacr.org
Passive SSH Key Compromise via Lattices [pdf]
1–10 of 57 posts
Re: Passive SSH Key Compromise via Lattices [pdf]
#2Can anybody ELI5?
Re: Passive SSH Key Compromise via Lattices [pdf]
#3Can anybody ELI5?
Random hardware bit flips can cause invalid RSA signatures, which baddies can use to deduce private keys.
Edit: Don't ask me questions, i don't know shit, i just rephrased stuff from the linked paper.
Re: Passive SSH Key Compromise via Lattices [pdf]
#4RSA digital signatures can reveal a signer’s secret key if a computational or hardware fault occurs during signing with an unprotected
implementation using the Chinese Remainder Theorem and a deterministic padding scheme like PKCS#1 v1.5.
[...] In this context, a passive adversary can quietly monitor legitimate connections without risking detection until they observe
a faulty signature that exposes the private key. The attacker can then actively and undetectably impersonate the compromised host to intercept sensitive data.
And they say crypto is hard, sheesh...
Seriously though, almost every time I hear about some new (to me) attack, I get amazed at the ingenuity of people.
Re: Passive SSH Key Compromise via Lattices [pdf]
#5Re: Passive SSH Key Compromise via Lattices [pdf]
#6Can anybody ELI5?
How about ELI precocious 10 year old? Cosmic rays and thermal effects cause random bit flips in memory very infrequently. If you sit on a network and listen to TLS handshakes for long enough, you'll find that any given server will issue the wrong signature occasionally, because of these bit flips. If you record the wrong signature(s) and use a fancy algorithm, you can recover the private key.
While at first it may seem an unlikely attack, it's probably more real than you'd think, given the number of times any single server does TLS negotiation using a given private key. The attack becomes even more likely when you realize that multiple servers will be using the private key.
In practice, this gives middle boxes more power, and raises their profile in the threat model significantly. This also opens up the possibility of simply collecting failed transient failed tls negotation data from a large number of (legitimate) clients to reconstruct a private key.
Re: Passive SSH Key Compromise via Lattices [pdf]
#7So the vast majority of servers is not at risk because OpenSSH is not vulnerable to these attacks?
Re: Passive SSH Key Compromise via Lattices [pdf]
#8RSA digital signatures can reveal a signer’s secret key if a computational or hardware fault occurs during signing with an unprotected implementation using the Chinese Remainder Theorem and a deterministic padding scheme like PKCS#1 v1.5. [...] In this context, a passive adversary can quietly monitor legitimate connections without risking detection until they observe a faulty signature that exposes the private key. T…
Crypto is hard, and part of the hardness is implementing it correctly.
Re: Passive SSH Key Compromise via Lattices [pdf]
#9Can anybody ELI5?
Random hardware bit flips can cause invalid RSA signatures, which baddies can use to deduce private keys. Edit: Don't ask me questions, i don't know shit, i just rephrased stuff from the linked paper.
Does each bit flip reveal a bit or less or does somehow a single flip compromise the entire key?
Re: Passive SSH Key Compromise via Lattices [pdf]
#10RSA digital signatures can reveal a signer’s secret key if a computational or hardware fault occurs during signing with an unprotected implementation using the Chinese Remainder Theorem and a deterministic padding scheme like PKCS#1 v1.5. [...] In this context, a passive adversary can quietly monitor legitimate connections without risking detection until they observe a faulty signature that exposes the private key. T…
> using the Chinese Remainder Theorem
Damn those Chinese hackers again!