One&Done: A Single-Decryption EM-Based Attack on OpenSSL’s Constant-Time Blinded RSA
summary
Describes an electromagnetic (EM) side‑channel attack that extracts RSA secret-exponent bits from a single OpenSSL fixed-window constant-time decryption by recording processor EM emanations around the clock frequency (≈1 GHz) using a narrow-band SDR. The method targets the analog signals produced while the implementation builds each exponent window (not cache/timing or multiply/square operations), demonstrates recovery on two phones and an embedded system, and shows that recovered bits from one ciphertext suffice to reconstruct the full private key. Proposes and notes an OpenSSL-merged mitigation that groups exponent bits into integer-sized chunks so each EM snippet must reveal many bits at once, making per-bit recovery impractical.
AI-written summary · about
chapters (15)
- 0:00Intro
- 0:32Motivation
- 0:54Public Key Crypto
- 1:39Analog Side-Channel Attacks
- 3:52OpenSSL's RSA Implementation
- 4:58Side-Channel Attacks on OpenSSL's RSA
- 6:48Measurement Setup
- 7:30Side Channel Analysis
- 9:04Attack Approach
- 11:35How well does this recover bits of?
- 13:05Full RSA Key Recovery
- 16:41Recover RSA key from with errors
- 18:15More in the paper
- 20:41Results after mitigation
- 21:31Conclusions
related talks
01h 02mCryptographic Side-Channels on Embedded Devices
05mHow to defend from an attacker armed with a mathematician
26mConstant-Time Callees with Variable-Time Callers
21mHow to defend from an attacker armed with a mathematician
42mRecover a RSA Private Key From a TLS Session With Perfect Forward Secrecy
52mAsymmetric Encryption: A Deep Dive
58mAsymmetric Encryption: A Deep Dive
51mA Retrospective on the Use of Export Cryptography