Constant-Time Callees with Variable-Time Callers
summary
Discloses a bug in OpenSSL 1.0.1u where the constant-time flag for modular inversion is unset so code falls back to a binary extended Euclidean inverse that leaks nonce-dependent shifts and subtractions, exploited with flush+reload + performance degradation cache measurements to recover inversion state sequences. Converts short operation sequences into bits, feeds them into a lattice solver and recovers P-256 ECDSA private keys with about 50 signatures, demonstrates end-to-end recovery over TLS/SSH, and supplies a patch.
AI-written summary · about
chapters (6)
- 0:00Start
- 14:47The Binary Extended Euclidean Algorithm
- 17:22Improved Performance Accreditation Attack
- 18:16Setup and Attack Scenario
- 20:01Recover Bits out of the Sequence of Operations
- 24:01Conclusion
related talks
24mSoK: The Constant Time Model
28mOne&Done: A Single-Decryption EM-Based Attack on OpenSSL’s Constant-Time Blinded RSA
53mOpenSSL Deep Dive: The Good, Bad And Not-So-Ugly
01h 02mCryptographic Side-Channels on Embedded Devices
14mProtecting cryptography code from timing vulnerabilities
54mBroken Crypto is Broken
37mFrontiers in Cryptography
24mWhy you shouldn't write crypto functions yourself