Discussion: Remote Timing Attacks are Practical 600.624 2/11/05

Outline • Why are timing attacks important? • Clarifications • Zero-One Gap / Neighborhood Size etc. • Problems • Questions • Extensions • Contribution • Discussion

How fast can we factor? • Seny: RSAP. How do you go after crypto? • RSA Challenge • RSA-576 • 576 bits (174 digits) • Factored in 2 years (2001-2003) used “Lattice Sieving” • http://www.rsasecurity.com/rsalabs/

How fast can we factor? (2) • Number Field Sieves • “Fast Algorithms” • Complexity: O ( e c (log n ) 1 / 3 (log log n ) 2 / 3 )

Dangers of Timing Attacks • Probably not going to crack RSA (or El Gamal) any time soon • Dangers: Poor passwords (keys, entropy), timing attacks

Clarifications

What is the Zero-One Gap? Zero-One Gap = | � 1 - � 0 | � 1 � 0 time guess of q

Zero-One Gap

What is the “neighborhood size”? • Need to get better estimates at number of reductions (more on that later...) n � T g = DecryptTime ( g + i ) 1=0 n � T g hi = DecryptTime ( g hi + i ) 1=0 ∆ = | T g − T g hi | • Why increment i ? (Multiplication??)

Neighborhood

1 ms? • State that 1 ms of Zero-One Gap is sufficient for attack. • Where did this number come from?

1 ms (2) Can we really tolerate 1 ms network variance?

Problems

Great Paper! (?) • Were the mathematics adequately explained? • Did they provide empirical evidence that this attack is feasible?

“remote timing attacks are PRACTICAL “ • Setup: • 3 Hop Network • Load on the server • Experiments: • broke 2.5/3 keys • sample size (?!?) • What does this mean for failure rate?

Questions • What about the first bits?

Questions (2) • Would using OAEP prevent the attack? • Quick Answer: no. • What about RSA Signatures? • hashing?

Questions (3) • Why include the VM Model? • Some people liked it... • What is the failure rate? • Come back to this...

Questions (4) • How are they averaging their timing samples? • What does this imply about distribution? • What does this mean about their error rate?

Defenses (”Hacks”) • Queueing Algorithms • Add a delay on decryption failure • Application layer Firewall • What about RSA batching?

Better Defenses (?) • Blinding • “Are we wrong to rely on blinding considering it isn’t provably secure?” • Quantizing

Extensions • What is the smallest neighborhood/sample size parameters such that the attack will work?

Extensions (2) • Are there p/q or e/d pairs for which Multiplication and Reductions offset? (See key 3.) If so, what percent of the key space is vulnerable? (HARD??)

Contribution • We all accepted this paper... discuss why.

Discussion • Anything you would like to bring up?

Discussion: Remote Timing Attacks are Practical 600.624 2/11/05 - PowerPoint PPT Presentation

Discussion: Remote Timing Attacks are Practical 600.624 2/11/05 Outline Why are timing attacks important? Clarifications Zero-One Gap / Neighborhood Size etc. Problems Questions Extensions Contribution Discussion

Remote Timing Attacks are Still Practical Billy Brumley Nicola Tuveri Aalto University School of

Remote Timing Attacks are Practical by David Brumley and Dan Boneh Presented by Seny Kamara in

Remote Timing Attacks on TPMs, AKA TPM-Fail Daniel Moghimi About Me Daniel Moghimi

The Clock is Still Ticking: Timing Attacks in the Modern Web Tom Van Goethem, Wouter Joosen,

Digital Design Discussion: RTL Storage Components Shift Register Timing Register File Timing

NetCAT : Practical Cache Attacks from the Network Michael Kurth , Ben Gras, Dennis Andriesse,

Cache-Timing Attacks Matteo BOCCHI System Research & Applications STMicroelectronics S.r.l.

DTCP + Remote Access Proposal for Discussion with 3S October 28, 2009 1 Remote Access (RA)

DISTRIBUTED SYSTEMS Practical Lab Remote Method Invocation 2 A pragmatic Introduction RMI -

No Pardon for the Interruption: New Inference Attacks on Android Through Interrupt Timing

Determinating Timing Channels in Compute Clouds Amittai Aviram, Sen Hu, Bryan Ford Yale

Exclusive Exponent Blinding May Not Suffice Attacks on RSA to Prevent Timing Attacks on RSA

Plugging Side-Channel Leaks with Timing Information Flow Control Bryan Ford Yale University

CACHE-TIMING ATTACKS ON RSA KEY GENERATION Conference on Cryptographic Hardware and Embedded

Cache-timing attacks http://cr.yp.to/papers.html #cachetiming , 2005: D. J. Bernstein This

Practical Padding Oracle Attacks J. Rizzo T. Duong Black Hat Europe, 2010 J. Rizzo, T. Duong

AOS Linux Tutorial Remote Access and Transferring Files Michael Havas Dept. of Atmospheric and

Linux on Sun Logical Domains David S. Miller Red Hat Inc. linux.conf.au, MEL8OURNE, 2008 David

Smart metering architecture to enable and simulate novel services in smart grids Edoardo Patti

Tutorial on Adversarial Machine Learning with CleverHans Nicholas Carlini University of

Lec08: Remote Exploit Taesoo Kim 2 Scoreboard 3 NSA Codebreaker Challenges 4 Administrivia

Uncovering Zero-Days and advanced fuzzing How to successfully get the tools to unlock UNIX and

Security Analysis of Emerging Smart Home Applications Earlence Fernandes, Jaeyeon Jung, Atul

A WMI S HELL A new way to get shells on remote Windows machines using only the WMI service LEXSI