6 ms·
Tempest attacks against AES: Stealing keys using minimal equipment [pdf]
- JoachimSchipper 9y agoThis is research by my close colleagues; I'm happy to answer any questions.
- calculat0r 9y agoWhat mode of operation of AES was used for the analysis?
- JoachimSchipper 9y agoECB, I think? The focus was definitely on attacking the crypto core per se. (Of course, ECB is almost certainly a bad idea if you're trying to build an actual application!)
- cramsay 9y agoYes, ECB, although other modes would only require superficial changes. In practice the harder task is actually identifying the mode in use!
- enimodas 9y agoDoesn't the device case act as a faraday cage?
- JoachimSchipper 9y agoLess so than we expected; a metallic case definitely reduces the signal strength, but IIRC for the one case we tried placing, the small-loop antenna directly on the case still gets you a good-enough signal to break this (pretty basic) AES implementation. Someone could definitely do more research into that, though - we only did a one-off experiment. Of course, everyone uses plastic nowadays... ;-)
- marcosdumay 9y ago> but IIRC for the one case we tried placing, the small-loop antenna directly on the case still gets you a good-enough signal Was the case grounded? Laptops are mostly plastic and some non-grounded metal. Desktops are mostly grounded steel. Steel may be permeable enough for a tempest attack. I don't know.
- cramsay 9y agoGood point. The case wasn't grounded but that is more common for embedded targets/laptops. We haven't looked at attacking desktops but the fact that there is a market for tempest shielded desktops (from OSPL, etc.) is perhaps an indication that it might still be possible...
- 2sk21 9y agoI remember reading about such attacks for the first time in Neal Stephenson's book Cryptonomicon under the term "Van Eck Phreaking". Looks like its gotten a lot easier in recent years!
- ckastner 9y agoThis was the AES implementation this was tested against: The trace below shows our signal for one block of AES-256 encryption running on a SmartFusion2 target. We use OpenSSL's implementation of AES on the ARM Cortex-M3 core of the SmartFusion2. There are clear, distinct patterns for each stage of processing. We see I/O to and from the Cortex-M3, calculations for the key schedule, and the 14 encryption rounds. So it was a software implementation. I wonder if and how effective this attack would be against devices with hardware implementations of AES.
- hvidgaard 9y agoAll it does is messuring power consumtion and uses knowledge about the implementation to calculate the key. Unless steps have been taken to equal power consumption between different paths, theoretically there is nothing stopping this from working on a hw implementaion of AES.
- devdoomari 9y ago...how about a random-power-consumer? would it help?
- Klathmon 9y agoGenerally mitigations like adding random things only delay attacks like this, they don't prevent them. Like adding random timings won't prevent timing attacks, adding random sized strings won't prevent chosen plaintext or padding attacks, etc...
- joantune 9y agoalright, portable faraday cages for everyone!
- ishitatsuyuki 9y agoWell, in many cases AES keys are used one time, and there's also forward secrecy that guards it from decryption even if the key leaked.
- the8472 9y agoForward secrecy does not protect the data for which the key was leaked (which could be at-rest data), it only protects future transmissions.
- JoachimSchipper 9y ago"Algorithmic countermeasures" - that is, switching keys quickly - can indeed hinder side-channel attacks. Be careful not to introduce more problems than you solve, though - hand-rolling your own crypto is something to leave to a team of experts (because you definitely want someone reviewing your design!)
- 5gaKanchAFD2 9y agoThis is a common countermeasure. You need to be aware that you maybe just be moving the problem. In settings in which key agreement techniques aren't used you'll be deriving new symmetric keys from an initial secret using a KDF. You now need to make sure that the KDF is DPA-resistant. Forward secrecy is defined with respect to key agreement schemes and not symmetric crypto per se.
- xcz 9y agoCan someone ELI5 how this works? Would be much appreciated <3
- u123u4 9y agoCould this be used to break my existing hard drive encryption, or does it only apply to the key generation stage?
- celticninja 9y agoit can read when the keys are used, i believe, but the attacker would need to know when the keys were used to identify the right time. However at 30cm this is someone standing at your desk waiting for you to fire up an instance or something.
- JoachimSchipper 9y agoIn theory, yes. In practice, just grabbing your unlocked laptop and running off is a lot simpler than our/my colleagues' attack. ;-)
- marcosdumay 9y agoA "mind if I share that table" attack might be much more useful than explicitly taking some laptop and running away with it. It completely depends on your threat model.
- deleted 9y ago[deleted]
- forg0t_username 9y agoBasically, the current in a circuit is dependent of the data manipulated: changing a value from 0 to 1 or 1 to zero generates a current to (dis)charge the gate capacitances. Maxwell's equations state that a current generates an electromagnetic field, and this field is perceived by the antenna. The attacker is then seeing electromagnetic waves related to the data manipulated. By carefully comparing the waves with waves where the key is known, the attacker can then guess the key bit by bit.
- sqldba 9y agoI read it a few times and still don't understand how you can get like the 4k of private key data or whatever it is out of a radio signal - and they don't even mention keys they're talking about the algorithm itself. Totally don't get it in the slightest.
- buu700 9y agohttps://en.wikipedia.org/wiki/Timing_attack https://en.wikipedia.org/wiki/Timing_attack. (Also, AES-256 keys are only 32 bytes, not 4 KB.)
- JoachimSchipper 9y agoThat gives the correct flavour, but note that we use a different side-channel than timing - this is really a hardware attack, so we e.g. pick up 0->1 transitions in the address bus.
- buu700 9y agoAh, thanks for clarifying that; I'd just assumed it was timing from a quick skim.
- wizeman 9y agoAre there any modern crypto algorithms that are, by design, immune from an attack such as this? Would not having any key-dependent code paths be sufficient to prevent this attack? If it is possible to be immune by design to power analysis, timing and tempest attacks, is there a list of such algorithms somewhere that I can look it up? My google-fu hasn't returned anything useful.
- deleted 9y ago[deleted]
- technion 9y agoChacha20 was designed to be immune to timing attacks. It's discussed on page three: https://datatracker.ietf.org/doc/html/draft-irtf-cfrg-chacha20-poly1305-10 https://datatracker.ietf.org/doc/html/draft-irtf-cfrg-chacha...
- forg0t_username 9y agoThe keyword you're looking for is masking. Masked implementations of AES resist this exact attack without problem. Higher-order attacks are then needed, and those require exponentially more computation.
- JoachimSchipper 9y agoSide-channel-resistance is a property of the algorithm, not of the implementation. As technion says, ChaCha20 was designed such that the evident software implementation resists such attacks; however, Schwabe and Kasper also have a high-quality software implementation of AES. Hardware implementations are a different beast altogether, and a lot of expertise has gone into making hardened AES implementations in hardware (as forg0t_username says, masking helps - but this is an entire field of study. Look at some CHES conference papers to get an idea.)
- marcosdumay 9y agoChaCha20 does not survive tempest attacks like this one. No algorithm does. This attack is reading data directly from the bus between RAM and the CPU. You can not make an algorithm that survives that.
- celticninja 9y agoI'm all for the sharing of information and responsible disclosure etc, but when a company that makes stuff that is supposed to be protected from this sort of attack, then shows how if you dont buy their stuff you are at risk from anyone who can follow their plans and has $200, which they likely couldn't do yesterday, it doesnt seem to be as consumer friendly as it could be. more protection racket perhaps,
- deleted 9y ago[deleted]
- JoachimSchipper 9y agoWe're just showing the capability; it's not like we're throwing a ready-made attack kit on the internet. And it's not like we could coordinate disclosure with "everyone who has ever shipped an AES implementation".
- molticrystal 9y agoThere was an attempt to do something similar with ps3 http://www.eurasia.nu/modules.php?name=Forums&file=viewtopic&topic=7266&forum=87 http://www.eurasia.nu/modules.php?name=Forums&file=viewtopic... , progress stopped though.
- amq 9y agoGuys, stop breaking the world! /s
- mhkool 9y agoAn intelligent noise generator that runs as the second hardware thread on the same CPU using should be able to protect the encryption. If the second noise-generation thread is able to randomly stop the encryption thread and do itself some random crypto, it should be able to fool the eavesdropper which will assume that the signals of the noise thread is produced by the encryption thread. One can also think about modifying the implemenation of OpenSSL and others by inserting a lot of noise in the algorithm itself. One can also ask chip designers to modify the circuitry to produce a lot of noise during AES instructions. Or do the opposite in circuitry: use something comparable to active noise cancellation in headphones.
- wdb 9y agoOff topic, but I always wondered how defense forces deal with encryption of channel when they collaborate with other forces from different countries. You would somehow be able to add a new participant to the group. Would this require re-issue of keys?