Practical timing and SEMA on embedded OpenSSL's ECDSA - Archive ouverte HAL Accéder directement au contenu
Communication Dans Un Congrès Année : 2022

Practical timing and SEMA on embedded OpenSSL's ECDSA

Résumé

Timing attacks are a class of side-channel attacks allowing an adversary to recover some sensitive data by observing the execution time of some underlying algorithm. Several cryptographic libraries have been shown to be vulnerable against these attacks, oftentimes allowing practical key recoveries. While recent papers showed that these threats are wellknown amongst developers, these libraries are often left unpatched, due to the perceived burden of implementing efficient countermeasures. Instead, many libraries chose to modify their threat model and to not consider attacks where the adversary have local access to the target anymore. In this paper, we show how to implement, on a real world device, a recent timing attack described by Weiser et al. at Usenix20, targeting OpenSSL's ECDSA. We expand their discovery and demonstrate that this attack applies to a bigger set of curves than claimed in the original paper. After characterising the weakness against timing, we show that the perceived safety that can be provided by a practical resistance against those attacks can easily be shattered using slightly costlier attacks such as Simple ElectroMagnetic Analysis. Our work hence highlight that secure embedded purposes require a very careful choice of side-channel resistant library.
Fichier principal
Vignette du fichier
SSTIC2022-Article-practical_timing_and_sema_on_embedded_openssls_ecdsa-.pdf (532.61 Ko) Télécharger le fichier
Origine : Fichiers produits par l'(les) auteur(s)

Dates et versions

hal-03961697 , version 1 (29-01-2023)

Identifiants

  • HAL Id : hal-03961697 , version 1

Citer

Julien Eynard, Guénaël Renault, Franck Rondepierre, Adrian Thillard. Practical timing and SEMA on embedded OpenSSL's ECDSA. SSTIC 2022, Jun 2022, Rennes, France. ⟨hal-03961697⟩
9 Consultations
16 Téléchargements

Partager

Gmail Facebook X LinkedIn More