Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tempest attacks against AES: Stealing keys using minimal equipment [pdf]

fox-it.com

Post reply on HN
Print view View original

21–30 of 69 posts

Re: Tempest attacks against AES: Stealing keys using minimal equipment [pdf]

#21

Post by technion »

wizeman wrote: post #19

Are there any modern crypto algorithms that are, by design, immune from an attack such as this? Would not having any key-dependent code paths be sufficient to prevent this attack? If it is possible to be immune by design to power analysis, timing and tempest attacks, is there a list of such algorithms somewhere that I can look it up? My google-fu hasn't returned anything useful.

Chacha20 was designed to be immune to timing attacks. It's discussed on page three:

https://datatracker.ietf.org/doc/html/draft-irtf-cfrg-chacha...

Re: Tempest attacks against AES: Stealing keys using minimal equipment [pdf]

#22

Post by celticninja »

I'm all for the sharing of information and responsible disclosure etc, but when a company that makes stuff that is supposed to be protected from this sort of attack, then shows how if you dont buy their stuff you are at risk from anyone who can follow their plans and has $200, which they likely couldn't do yesterday, it doesnt seem to be as consumer friendly as it could be. more protection racket perhaps,

Re: Tempest attacks against AES: Stealing keys using minimal equipment [pdf]

#23

Post by celticninja »

u123u4 wrote: post #18
xcz wrote: post #16

Can someone ELI5 how this works? Would be much appreciated <3

Could this be used to break my existing hard drive encryption, or does it only apply to the key generation stage?

it can read when the keys are used, i believe, but the attacker would need to know when the keys were used to identify the right time. However at 30cm this is someone standing at your desk waiting for you to fire up an instance or something.

Re: Tempest attacks against AES: Stealing keys using minimal equipment [pdf]

#24

Post by [deleted] »

celticninja wrote: post #22

I'm all for the sharing of information and responsible disclosure etc, but when a company that makes stuff that is supposed to be protected from this sort of attack, then shows how if you dont buy their stuff you are at risk from anyone who can follow their plans and has $200, which they likely couldn't do yesterday, it doesnt seem to be as consumer friendly as it could be. more protection racket perhaps,

[deleted]

Re: Tempest attacks against AES: Stealing keys using minimal equipment [pdf]

#25

Post by buu700 »

sqldba wrote: post #17

I read it a few times and still don't understand how you can get like the 4k of private key data or whatever it is out of a radio signal - and they don't even mention keys they're talking about the algorithm itself. Totally don't get it in the slightest.

https://en.wikipedia.org/wiki/Timing_attack. (Also, AES-256 keys are only 32 bytes, not 4 KB.)

Re: Tempest attacks against AES: Stealing keys using minimal equipment [pdf]

#26

Post by user5994461 »

hvidgaard wrote: post #4
ckastner wrote: post #3

This was the AES implementation this was tested against: The trace below shows our signal for one block of AES-256 encryption running on a SmartFusion2 target. We use OpenSSL's implementation of AES on the ARM Cortex-M3 core of the SmartFusion2. There are clear, distinct patterns for each stage of processing. We see I/O to and from the Cortex-M3, calculations for the key schedule, and the 14 encryption rounds. So it…

All it does is messuring power consumtion and uses knowledge about the implementation to calculate the key. Unless steps have been taken to equal power consumption between different paths, theoretically there is nothing stopping this from working on a hw implementaion of AES.

There is a paper on stealing RSA keys, by listening to the sound the power supply of a laptop makes, from 4 meters away with a microphone. Works wonders!

Re: Tempest attacks against AES: Stealing keys using minimal equipment [pdf]

#27

Post by forg0t_username »

wizeman wrote: post #19

Are there any modern crypto algorithms that are, by design, immune from an attack such as this? Would not having any key-dependent code paths be sufficient to prevent this attack? If it is possible to be immune by design to power analysis, timing and tempest attacks, is there a list of such algorithms somewhere that I can look it up? My google-fu hasn't returned anything useful.

The keyword you're looking for is masking. Masked implementations of AES resist this exact attack without problem. Higher-order attacks are then needed, and those require exponentially more computation.

Re: Tempest attacks against AES: Stealing keys using minimal equipment [pdf]

#28

Post by laydn »

devdoomari wrote: post #7
hvidgaard wrote: post #4

Earlier quoted context omitted.

All it does is messuring power consumtion and uses knowledge about the implementation to calculate the key. Unless steps have been taken to equal power consumption between different paths, theoretically there is nothing stopping this from working on a hw implementaion of AES.

...how about a random-power-consumer? would it help?

Cryptography Research (now RAMBUS) developed solutions against these DPA attacks. Real solutions are much more complex than just "random-power-consuming"

See: https://www.rambus.com/security/dpa-countermeasures/

Post reply on HN