Discussion: Remote Timing Attacks are Practical 600.624 2/11/05 - PowerPoint PPT Presentation

Aug 27, 2023 •371 likes •645 views

Discussion: Remote Timing Attacks are Practical 600.624 2/11/05 Outline Why are timing attacks important? Clarifications Zero-One Gap / Neighborhood Size etc. Problems Questions Extensions Contribution Discussion

Discussion: Remote Timing Attacks are Practical 600.624 2/11/05
Outline • Why are timing attacks important? • Clarifications • Zero-One Gap / Neighborhood Size etc. • Problems • Questions • Extensions • Contribution • Discussion
How fast can we factor? • Seny: RSAP. How do you go after crypto? • RSA Challenge • RSA-576 • 576 bits (174 digits) • Factored in 2 years (2001-2003) used “Lattice Sieving” • http://www.rsasecurity.com/rsalabs/
How fast can we factor? (2) • Number Field Sieves • “Fast Algorithms” • Complexity: O ( e c (log n ) 1 / 3 (log log n ) 2 / 3 )
Dangers of Timing Attacks • Probably not going to crack RSA (or El Gamal) any time soon • Dangers: Poor passwords (keys, entropy), timing attacks
Clarifications
What is the Zero-One Gap? Zero-One Gap = | � 1 - � 0 | � 1 � 0 time guess of q
Zero-One Gap
What is the “neighborhood size”? • Need to get better estimates at number of reductions (more on that later...) n � T g = DecryptTime ( g + i ) 1=0 n � T g hi = DecryptTime ( g hi + i ) 1=0 ∆ = | T g − T g hi | • Why increment i ? (Multiplication??)
Neighborhood
Neighborhood
1 ms? • State that 1 ms of Zero-One Gap is sufficient for attack. • Where did this number come from?
1 ms (2) Can we really tolerate 1 ms network variance?
Problems
Great Paper! (?) • Were the mathematics adequately explained? • Did they provide empirical evidence that this attack is feasible?
“remote timing attacks are PRACTICAL “ • Setup: • 3 Hop Network • Load on the server • Experiments: • broke 2.5/3 keys • sample size (?!?) • What does this mean for failure rate?
Questions • What about the first bits?
Questions (2) • Would using OAEP prevent the attack? • Quick Answer: no. • What about RSA Signatures? • hashing?
Questions (3) • Why include the VM Model? • Some people liked it... • What is the failure rate? • Come back to this...
Questions (4) • How are they averaging their timing samples? • What does this imply about distribution? • What does this mean about their error rate?
Defenses (”Hacks”) • Queueing Algorithms • Add a delay on decryption failure • Application layer Firewall • What about RSA batching?
Better Defenses (?) • Blinding • “Are we wrong to rely on blinding considering it isn’t provably secure?” • Quantizing
Extensions • What is the smallest neighborhood/sample size parameters such that the attack will work?
Extensions (2) • Are there p/q or e/d pairs for which Multiplication and Reductions offset? (See key 3.) If so, what percent of the key space is vulnerable? (HARD??)
Contribution • We all accepted this paper... discuss why.
Discussion • Anything you would like to bring up?

Recommend

Remote Timing Attacks are Still Practical Billy Brumley Nicola Tuveri Aalto University School of

Remote Timing Attacks are Still Practical Billy Brumley Nicola Tuveri Aalto University School of Science, Finland {bbrumley,ntuveri}@tcs.hut.fi Synopsis New remote timing attack vulnerability in OpenSSLs implementation of Montgomerys

487 views • 25 slides

Remote Timing Attacks are Practical by David Brumley and Dan Boneh Presented by Seny Kamara in

Remote Timing Attacks are Practical by David Brumley and Dan Boneh Presented by Seny Kamara in Advanced Topics in Network Security (600/650.624) Outline Traditional threat model in cryptography Side-channel attacks Kochers

1.19k views • 77 slides

Remote Timing Attacks on TPMs, AKA TPM-Fail Daniel Moghimi About Me Daniel Moghimi

Remote Timing Attacks on TPMs, AKA TPM-Fail Daniel Moghimi About Me Daniel Moghimi @danielmgmi https://moghimi.org Security Researcher PhD Candidate @ WPI Microarchitectural Attacks Side Channels Breaking Crypto

1.2k views • 71 slides

The Clock is Still Ticking: Timing Attacks in the Modern Web Tom Van Goethem, Wouter Joosen,

The Clock is Still Ticking: Timing Attacks in the Modern Web Tom Van Goethem, Wouter Joosen, Nick Nikiforakis Background: Timing attacks Introduced by Felten et al. in 2000. A side-channel attack analyzing the time that it takes to a

642 views • 21 slides

Digital Design Discussion: RTL Storage Components Shift Register Timing Register File Timing

Principles Of Digital Design Discussion: RTL Storage Components Shift Register Timing Register File Timing RAM Up/Down Counter FIFO Queue Shift Register Timing Problem: Complete the timing diagram for the shift register shown. Assume

302 views • 12 slides

NetCAT : Practical Cache Attacks from the Network Michael Kurth , Ben Gras, Dennis Andriesse,

NetCAT : Practical Cache Attacks from the Network Michael Kurth , Ben Gras, Dennis Andriesse, Cristiano Giuffrida, Herbert Bos, Kaveh Razavi Cache Attack from the Network Client Server Remote Cache Attack SSH 2 Network Cache Attack 3

794 views • 32 slides

Cache-Timing Attacks Matteo BOCCHI System Research & Applications STMicroelectronics S.r.l.

Cache-Timing Attacks Matteo BOCCHI System Research & Applications STMicroelectronics S.r.l. 2018/12/06 Agenda 2 STM32 Nucleo Boards STM32 Firewall Cache-Timing Attack Evict&Time vs. MbedTLS AES on STM32

477 views • 20 slides

DTCP + Remote Access Proposal for Discussion with 3S October 28, 2009 1 Remote Access (RA)

DTCP + Remote Access Proposal for Discussion with 3S October 28, 2009 1 Remote Access (RA) Basic Rules Remote Connection AKE RA Encoding Rules 2 Remote Access Basic Rules Source devices may permit remote access to content

326 views • 15 slides

DISTRIBUTED SYSTEMS Practical Lab Remote Method Invocation 2 A pragmatic Introduction RMI -

1 DISTRIBUTED SYSTEMS Practical Lab Remote Method Invocation 2 A pragmatic Introduction RMI - Overview 3 Simple idea: In an OO-program objects communicate via methods For remote communication why not allow an object to

343 views • 11 slides

No Pardon for the Interruption: New Inference Attacks on Android Through Interrupt Timing

IEEE S&P 2016 No Pardon for the Interruption: New Inference Attacks on Android Through Interrupt Timing Analysis May 24, 2016 Wenrui Diao , Xiangyu Liu, Zhou Li, and Kehuan Zhang 2/18 Motivation -- Hardware and Kernel Mobile platform

700 views • 21 slides

Determinating Timing Channels in Compute Clouds Amittai Aviram, Sen Hu, Bryan Ford Yale

Determinating Timing Channels in Compute Clouds Amittai Aviram, Sen Hu, Bryan Ford Yale University http://dedis.cs.yale.edu/ Ramakrishna Gummadi University of Massechusetts Amherst CCSW, October 8, 2010 Timing Attacks Cooperative attacks

471 views • 30 slides

Exclusive Exponent Blinding May Not Suffice Attacks on RSA to Prevent Timing Attacks on RSA

Exclusive Exponent Blinding May Not Suffice to Prevent Timing Exclusive Exponent Blinding May Not Suffice Attacks on RSA to Prevent Timing Attacks on RSA Werner Schindler Bundesamt f ur Sicherheit in der Werner Schindler

553 views • 23 slides

Plugging Side-Channel Leaks with Timing Information Flow Control Bryan Ford Yale University

Plugging Side-Channel Leaks with Timing Information Flow Control Bryan Ford Yale University http://dedis.cs.yale.edu/ USENIX HotCloud, June 13, 2012 The Long History of Timing Attacks Cooperative attacks apply to: Mandatory Access

359 views • 21 slides

CACHE-TIMING ATTACKS ON RSA KEY GENERATION Conference on Cryptographic Hardware and Embedded

CACHE-TIMING ATTACKS ON RSA KEY GENERATION Conference on Cryptographic Hardware and Embedded Systems (CHES) 2019 Alejandro Cabrera Aldaya 1 , Cesar Pereida Garca 2 , Luis Manuel Alvarez Tapia 1 , Billy Bob Brumley 2 , {aldaya,

371 views • 21 slides

Cache-timing attacks http://cr.yp.to/papers.html #cachetiming , 2005: D. J. Bernstein This

Cache-timing attacks http://cr.yp.to/papers.html #cachetiming , 2005: D. J. Bernstein This paper reports successful Thanks to: extraction of a complete AES key University of Illinois at Chicago from a network server NSF CCR9983950 on

1.28k views • 91 slides

Practical Padding Oracle Attacks J. Rizzo T. Duong Black Hat Europe, 2010 J. Rizzo, T. Duong

Introduction Finding Padding Oracles Basic PO attacks Advanced PO attacks Summary Practical Padding Oracle Attacks J. Rizzo T. Duong Black Hat Europe, 2010 J. Rizzo, T. Duong Practical Padding Oracle Attacks Introduction Finding Padding

1.33k views • 108 slides

Practical Attacks on Implementations Juraj Somorovsky Ruhr University Bochum, HGI 3curity

Practical Attacks on Implementations Juraj Somorovsky Ruhr University Bochum, HGI 3curity @jurajsomorovsky 1 Practi tical l Attacks on Real l World ld Crypto to Imple lementa mentati tion ons Juraj Somorovsky 1 Recent years

406 views • 29 slides

Why Some Like It Loud: Timing Power Attacks in Multi-tenant Data Centers Using an Acoustic Side

Why Some Like It Loud: Timing Power Attacks in Multi-tenant Data Centers Using an Acoustic Side Channel Mohammad A. Islam, Luting Yang, Kiran Ranganath, and Shaolei Ren Acknowledgement: This work was supported in part by NSF under grants

445 views • 31 slides

Baseband Attacks: Remote Exploitation of Memory Corruptions in Cellular Protocol Stacks

Baseband Attacks: Remote Exploitation of Memory Corruptions in Cellular Protocol Stacks Author: Ralf-Philipp Weinmann University of Luxembourg WOOT, USENIX, 2012. Presenter: Hyuntae Kim Part 1. Introduction - GSM overview - MS-BTS

1.2k views • 42 slides

Reasoning about Aggregation of Information in Timing Attacks Boris Kpf Itsaka Rakotonirina

Reasoning about Aggregation of Information in Timing Attacks Boris Kpf Itsaka Rakotonirina Microsoft Research INRIA Nancy Grand-Est Choose a letter: A or B. Choose a letter: A or B. Does it occur more than 10 times in TARATATATARATATATA ?

1.18k views • 65 slides

TPM-Fail TPM meets Timing and Lattice Attacks Daniel Moghimi Berk Sunar Thomas Eisenbarth

TPM-Fail TPM meets Timing and Lattice Attacks Daniel Moghimi Berk Sunar Thomas Eisenbarth Nadia Heninger 01/08/2020 Real World Crypto TPM 2 Trusted Platform Module (TPM) Software is Hackers? insecure. Bad Guys? Heartbleed? Rootkits?

437 views • 39 slides

Remote IP Protection Using Timing Channels Ariano-Tim Donda 1 , 2 Peter Samarin 1 , 2 Jacek

Remote IP Protection Using Timing Channels Ariano-Tim Donda 1 , 2 Peter Samarin 1 , 2 Jacek Samotyja 1 Kerstin Lemke-Rust 1 Christof Paar 2 1 Bonn-Rhein-Sieg University of Applied Sciences, Germany 2 Ruhr University Bochum, Germany December 4, 2014

197 views • 18 slides

Final Discussion Thank you for your participation also to all our remote participants!

Final Discussion Thank you for your participation also to all our remote participants! Timeline for the White Paper Earliest possible release date for Fermilab g-2 measurement: 15-20 December 2019 Post the WP on arXiv by: 1 Dec.

301 views • 11 slides

Software Engineering Large Practical: Accessing remote data and XML parsing Stephen Gilmore

Software Engineering Large Practical: Accessing remote data and XML parsing Stephen Gilmore School of Informatics October 8, 2017 Contents 1. Android system permissions 2. Getting a network connection 3. Accessing remote data 4. Parsing XML

627 views • 37 slides