Cool new attack on static (non-EC) Diffie-Hellman in OpenSSL. Takes advantage of a timing vulnerability on the server side to extract the connection pre-master secret. Crypto implementations are hard. raccoon-attack.com
This is such an insane attack. You literally get a tiny timing oracle that tells you whether the DH secret begins with a zero byte. And then you just repeat that experiment until you’ve got the whole key. We’re all doomed.
In practice this isn’t a terribly big deal. Static DH is rare and is going away in recent versions. This is further evidence that maybe it should go away faster.
Anyway, I want to add this to the pile of “real, in the wild exploitable timing channels” which, I note, still does not seem to include very many instances of people attacking deep into primitives like EC point mul or stream cipher encryption, where all the brains are focused.
In other words, the name of the game for real exploitable timing channels is “someone did a dumb thing with a protocol” not “they didn’t use my favorite elliptic curve” which is messy and unsatisfying and, it seems, vastly more important.
• • •
Missing some Tweet in this thread? You can try to
force a refresh
