5
$\begingroup$

I was reading up on the recently disclosed Hertzbleed side channel attack(s).

It was speculated on Twitter that the Bitcoin cryptography library libsecp256k1 is not susceptible to these attacks. Firstly, is this true and why? Secondly, if it is true should these protections (e.g. blinding factors) be implemented in other cryptography libraries (not necessarily Bitcoin, cryptocurrency related) to protect against these attacks?

$\endgroup$

1 Answer 1

7
$\begingroup$

It's really much too early to make a definitive statement one way or the other on this.

The information leakage is based on a feature of some CISC architectures to allow a variable clockrate depending on power consumption. This is independent of a great many constant time execution approaches and existing coding practices may well be insufficient to block it per the Hertzbleed website:

The result is that current industry guidelines for how to write constant-time code (such as Intel’s one) are insufficient to guarantee constant-time execution on modern processors.

In fact as the community examines more of the effects that can trigger CPU throttling, I anticipate that it would be possible to write a compiler that makes various existing cryptographic libraries vulnerable and certainly possible to design an instruction set and architecture that does. Whether the current binaries and chips produce enough leakage to compromise security is hard to determine with such a new approach. The Hertzbleed team have done their demonstration using SIKE which is a very heavy duty computation that takes many cycles and so particularly likely to trigger frequency scaling. It's a good choice to demonstrate that these effects exist and are exploitable, but does not yet provide much sense of how sensitive these effects might be to less computationally intensive cryptography. Again per the website

Your constant-time cryptographic library might be vulnerable if is susceptible to secret-dependent power leakage, and this leakage extends to enough operations to induce secret-dependent changes in CPU frequency. Future work is needed to systematically study what cryptosystems can be exploited via the new Hertzbleed side channel.

In short, there's no evidence that these libraries are currently vulnerable, but nor is there an especially good reason to believe that future analysis of CPU throttling will not turn up something.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.