Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tempest attacks against AES: Stealing keys using minimal equipment [pdf]

fox-it.com

Post reply on HN
Print view View original

31–40 of 69 posts

Re: Tempest attacks against AES: Stealing keys using minimal equipment [pdf]

#31

Post by JoachimSchipper »

ckastner wrote: post #3

This was the AES implementation this was tested against: The trace below shows our signal for one block of AES-256 encryption running on a SmartFusion2 target. We use OpenSSL's implementation of AES on the ARM Cortex-M3 core of the SmartFusion2. There are clear, distinct patterns for each stage of processing. We see I/O to and from the Cortex-M3, calculations for the key schedule, and the 14 encryption rounds. So it…

We (that is, our interns and my colleagues) also attacked a straightforward/naive hardware implementation in an FPGA (reconfigurable hardware); we/they achieved at least a few centimeters of distance (using the open-loop antenna shown.)

A truly hardened hardware implementation would be very hard to attack. The contribution of this work is mostly in showing that you can break realistic-but-not-great implementations very quickly, cheaply, and without needing to open most enclosures.

Re: Tempest attacks against AES: Stealing keys using minimal equipment [pdf]

#32

Post by JoachimSchipper »

user5994461 wrote: post #26
hvidgaard wrote: post #4

Earlier quoted context omitted.

All it does is messuring power consumtion and uses knowledge about the implementation to calculate the key. Unless steps have been taken to equal power consumption between different paths, theoretically there is nothing stopping this from working on a hw implementaion of AES.

There is a paper on stealing RSA keys, by listening to the sound the power supply of a laptop makes, from 4 meters away with a microphone. Works wonders!

You're referring to https://www.tau.ac.il/~tromer/acoustic/ and the line of related papers.

That's absolutely great work, but this work uses very different techniques: the authors of that line of papers feed inputs to the crypto core that amplify the dependency on the key, e.g. by ensuring that a square-and-multiply does all or no squares depending on a single bit of the key.

AES doesn't have the kind of algebraic structure that would allow such amplification, so we mostly have to do it the hard way. Fortunately, we had some very talented interns and significant in-house (analog and digital) signal processing expertise. (From colleagues' previous jobs.)

Re: Tempest attacks against AES: Stealing keys using minimal equipment [pdf]

#33

Post by forg0t_username »

xcz wrote: post #16

Can someone ELI5 how this works? Would be much appreciated <3

Basically, the current in a circuit is dependent of the data manipulated: changing a value from 0 to 1 or 1 to zero generates a current to (dis)charge the gate capacitances.

Maxwell's equations state that a current generates an electromagnetic field, and this field is perceived by the antenna. The attacker is then seeing electromagnetic waves related to the data manipulated.

By carefully comparing the waves with waves where the key is known, the attacker can then guess the key bit by bit.

Re: Tempest attacks against AES: Stealing keys using minimal equipment [pdf]

#34

Post by JoachimSchipper »

wizeman wrote: post #19

Are there any modern crypto algorithms that are, by design, immune from an attack such as this? Would not having any key-dependent code paths be sufficient to prevent this attack? If it is possible to be immune by design to power analysis, timing and tempest attacks, is there a list of such algorithms somewhere that I can look it up? My google-fu hasn't returned anything useful.

Side-channel-resistance is a property of the algorithm, not of the implementation.

As technion says, ChaCha20 was designed such that the evident software implementation resists such attacks; however, Schwabe and Kasper also have a high-quality software implementation of AES.

Hardware implementations are a different beast altogether, and a lot of expertise has gone into making hardened AES implementations in hardware (as forg0t_username says, masking helps - but this is an entire field of study. Look at some CHES conference papers to get an idea.)

Re: Tempest attacks against AES: Stealing keys using minimal equipment [pdf]

#35

Post by JoachimSchipper »

celticninja wrote: post #22

I'm all for the sharing of information and responsible disclosure etc, but when a company that makes stuff that is supposed to be protected from this sort of attack, then shows how if you dont buy their stuff you are at risk from anyone who can follow their plans and has $200, which they likely couldn't do yesterday, it doesnt seem to be as consumer friendly as it could be. more protection racket perhaps,

We're just showing the capability; it's not like we're throwing a ready-made attack kit on the internet. And it's not like we could coordinate disclosure with "everyone who has ever shipped an AES implementation".

Re: Tempest attacks against AES: Stealing keys using minimal equipment [pdf]

#36

Post by JoachimSchipper »

ishitatsuyuki wrote: post #6

Well, in many cases AES keys are used one time, and there's also forward secrecy that guards it from decryption even if the key leaked.

"Algorithmic countermeasures" - that is, switching keys quickly - can indeed hinder side-channel attacks. Be careful not to introduce more problems than you solve, though - hand-rolling your own crypto is something to leave to a team of experts (because you definitely want someone reviewing your design!)

Re: Tempest attacks against AES: Stealing keys using minimal equipment [pdf]

#37

Post by JoachimSchipper »

u123u4 wrote: post #18
xcz wrote: post #16

Can someone ELI5 how this works? Would be much appreciated <3

Could this be used to break my existing hard drive encryption, or does it only apply to the key generation stage?

In theory, yes. In practice, just grabbing your unlocked laptop and running off is a lot simpler than our/my colleagues' attack. ;-)

Re: Tempest attacks against AES: Stealing keys using minimal equipment [pdf]

#38

Post by JoachimSchipper »

buu700 wrote: post #25
sqldba wrote: post #17

I read it a few times and still don't understand how you can get like the 4k of private key data or whatever it is out of a radio signal - and they don't even mention keys they're talking about the algorithm itself. Totally don't get it in the slightest.

https://en.wikipedia.org/wiki/Timing_attack . (Also, AES-256 keys are only 32 bytes, not 4 KB.)

That gives the correct flavour, but note that we use a different side-channel than timing - this is really a hardware attack, so we e.g. pick up 0->1 transitions in the address bus.

Re: Tempest attacks against AES: Stealing keys using minimal equipment [pdf]

#39

Post by buu700 »

JoachimSchipper wrote: post #38
buu700 wrote: post #25

Earlier quoted context omitted.

https://en.wikipedia.org/wiki/Timing_attack . (Also, AES-256 keys are only 32 bytes, not 4 KB.)

That gives the correct flavour, but note that we use a different side-channel than timing - this is really a hardware attack, so we e.g. pick up 0->1 transitions in the address bus.

Ah, thanks for clarifying that; I'd just assumed it was timing from a quick skim.
Post reply on HN