3
$\begingroup$

I'm aware of attacks extracting information via timing and volume. But none that care or attack the actual cryptographic algorithm implementation or end up extracting the key.

Seeking examples if any for such attacks which happened outside the lab, Or evidence where we suspect this was the means of attack used.

Any side channel: timing, sound, power, something else?

$\endgroup$
6
  • 2
    $\begingroup$ I cite a few experiences in the Smart Card field here, and just added 1 and 3 are first-hand experience. I have detailed 1 here, with link to a video demo. I think I still have card samples for 3, perhaps 1. I trust reports that fault injection is routinely practiced with success. $\endgroup$ – fgrieu Sep 5 '20 at 5:36
  • 1
    $\begingroup$ Thank you, I indeed heard of smart card attacks, didn't think of those. These give the attacker a huge degree of control(Including fault injection). $\endgroup$ – Meir Maor Sep 5 '20 at 5:38
  • 1
    $\begingroup$ There is the classical attack from 1956 against the Hagelin cipher machine in the Egyptian embassy (see link.springer.com/article/10.1007/s00145-015-9224-2). $\endgroup$ – j.p. Sep 5 '20 at 6:17
  • 1
    $\begingroup$ When attackers attack crypto in the wild we often know about it. We have seen multiple instances of Beast and Poodle and MD5 collisions just to name a few. If for instance timing attacks on RSA were common I expect we would see some evidence of those. $\endgroup$ – Meir Maor Sep 5 '20 at 10:16
  • 1
    $\begingroup$ Not quite a side-channel attack, but related: When Organized Crime Applies Academic Results. $\endgroup$ – j.p. Sep 6 '20 at 21:42
2
$\begingroup$

None that recover the key?

  • Osvik, Shamir, Tromer, 2006: Recover AES-256 secret key of Linux’s dmcrypt in just 65 ms
  • AlFardan, Paterson, 2013: “Lucky13” recovers plaintext of CBC-mode encryption in pretty much all TLS implementations
  • Yarom, Falkner, 2014: Attack against RSA-2048 in GnuPG 1.4.13: “On average, the attack is able to recover 96.7% of the bits of the secret key by observing a single signature or decryption round.”
  • Benger, van de Pol, Smart, Yarom, 2014: “reasonable level of success in recovering the secret key” for OpenSSL ECDSA using secp256k1 “with as little as 200 signatures”

Those are all examples of timing attacks that were usable in the wild. Also, they're all timing attacks. Nevermind Spectre, Meltdown, and the plethora of other predictive branching vulnerabilities that followed suit. There's also the RSA "exponent 3" attack (which I may or may not have exploited myself one or 2 times against web servers' TLS certificates)

(edit: The exponent 3 attack isn't really a side-channel attack but it's so hilarious I couldn't resist.)

In short, most timing attacks can be performed in the wild. There was even an issue with Amazon AWS instances that allowed someone to steal encryption keys from other instances simply by creating an AWS free tier account.

The good news is, usually researchers find them before bad actors and there's time to develop a fix before it gets too crazy. But these attacks are very real and usually crippling; both on paper and in practice.

I might suggest reading this document [PDF] which outlines the nature of such attacks in slightly more detail.

$\endgroup$
10
  • 1
    $\begingroup$ These are all in the lab. The attacker chooses the scenario, knows the setup very well. isolates extra interference. And even if they are realistic attacks. There is a big difference between realistic attack and real attack. $\endgroup$ – Meir Maor Sep 5 '20 at 5:35
  • 2
    $\begingroup$ Lab conditions? The AWS attack I described was performed by researchers actually renting out an AWS instance; Meltdown was exploited through the web browsers of unsuspecting users; power-based attacks are successfully performed on ordinary laptops using a parabolic microphone at significant distance. None of those are "lab conditions" $\endgroup$ – Serpent27 Sep 5 '20 at 5:41
  • $\begingroup$ It was nearly an AWS lab. The conditions were perfect. Not really in the wild. $\endgroup$ – kelalaka Sep 5 '20 at 6:30
  • $\begingroup$ What does an "AWS lab" mean? The hardware wasn't owned or controlled by the researchers, and the server was running code from other Amazon clients. That's the definition of an in-the-wild attack. What you call perfect conditions I call a production server. $\endgroup$ – Serpent27 Sep 5 '20 at 6:34
  • $\begingroup$ Go on, get an AWS account and use your server. Now ask the researcher to locate your shared AWS instance! And wait for the attack! If not shared, forget about it. $\endgroup$ – kelalaka Sep 5 '20 at 7:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.