TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

ECDSA Key Extraction Side Channel in Multiple Crypto Libraries

86 点作者 randombit将近 7 年前

5 条评论

nayuki将近 7 年前
This is where BearSSL discusses its deliberate design choice to implement constant-time, constant-memory-access arithmetic for its cryptography:<p>* <a href="https:&#x2F;&#x2F;bearssl.org&#x2F;constanttime.html" rel="nofollow">https:&#x2F;&#x2F;bearssl.org&#x2F;constanttime.html</a><p>* <a href="https:&#x2F;&#x2F;bearssl.org&#x2F;ctmul.html" rel="nofollow">https:&#x2F;&#x2F;bearssl.org&#x2F;ctmul.html</a>
jamoes将近 7 年前
Looking at libgcrypt&#x27;s patch [1], it looks like the mitigation technique they&#x27;re using is to blind the private key and message hash with a random number before performing point addition, and then unblinding the result of the point addition. This unfortunately requires an extra 3 point multiplication operations, so it probably isn&#x27;t a good solution where performance is critical.<p>According to the article, the private key information is leaked through memory caches, so it looks like libgcrypt&#x27;s solution just ensures that the data written to memory caches is random, rather than leaking the private key.<p>Also according to the article, libsecp256k1 isn&#x27;t vulnerable, and they still only do 2 point multiplications [2] (compared to libgcrypt&#x27;s 5 point multiplications). So it <i>is</i> possible to mitigate this attack efficiently.<p>[1] <a href="https:&#x2F;&#x2F;lists.gnupg.org&#x2F;pipermail&#x2F;gnupg-announce&#x2F;2018q2&#x2F;000426.html" rel="nofollow">https:&#x2F;&#x2F;lists.gnupg.org&#x2F;pipermail&#x2F;gnupg-announce&#x2F;2018q2&#x2F;0004...</a><p>[2] <a href="https:&#x2F;&#x2F;github.com&#x2F;bitcoin-core&#x2F;secp256k1&#x2F;blob&#x2F;master&#x2F;src&#x2F;ecdsa_impl.h#L271" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;bitcoin-core&#x2F;secp256k1&#x2F;blob&#x2F;master&#x2F;src&#x2F;ec...</a>
Empact将近 7 年前
The constant-time operation implementation commits to libsecp256k1:<p><a href="https:&#x2F;&#x2F;github.com&#x2F;bitcoin-core&#x2F;secp256k1&#x2F;search?utf8=%E2%9C%93&amp;q=%22constant+time%22&amp;type=Commits" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;bitcoin-core&#x2F;secp256k1&#x2F;search?utf8=%E2%9C...</a>
profquail将近 7 年前
Could this attack be mitigated or otherwise slowed down by using non-temporal memory loads (x86: movntdqa) when reading the private key from memory? Or using clflush to evict the cached private key data from memory after each time it’s used?<p>The constant-time crypto in BearSSL seems like the best approach — I’m just curious if the above approaches could be used as a quick fix for the affected codebases until they can be fixed properly.
amaccuish将近 7 年前
Was just deciding whether to order smartcards with 4096 RSA or NIST ECC curve support. Whilst not directly related to this, I feel RSA has been examined more closely than ECC given it&#x27;s long history now of use. Not sure I fully trust the NIST curves, or have faith that ECC implementations have been thoroughly tested.
评论 #17307455 未加载
评论 #17308537 未加载
评论 #17307511 未加载