Hacker News Reader

HNHacker News

Top New Best Ask Show Jobs

Comment by dmitrygr | Hacker News Reader

Parent Full thread

dmitrygr·

AES is not linear thanks to the SubBytes step. You don't know the key. Good luck :)

View on HN

AES being linear or not is wholly irrelevant for this.

I recommend you read this article: https://en.wikipedia.org/wiki/Block_cipher_mode_of_operation

Please explain how you'll mutate a single bit of output given only input and no knowledge of key

If you use a mode like CTR you just flip the corresponding ciphertext bit. As for CBC there are padding-oracle attacks.

Do SSDs use CTR mode? How does one perform a padding oracle against an SSD? I feel like we're pretty far away from the relevant context, which is users corrupting data on an SSD.

XTS mode for block storage. Can't be CBC or CTR, where would you Store the IV or counter/nonce?

You could store it in the block metadata, which SSD flash translation layers already use for wear-leveling purposes.

This sounds more like random speculation than informed commentary.

Does the SSD let you read the raw ciphertext to perform that attack? Or does it only expose the decrypted data?

There is no documented way to read cyphertext. I am SURE some manufacturer specific commands exist. But they will likely be undocumented, model-specific, and may be locked away behind a manufacturer key

https://www.nccgroup.trust/us/about-us/newsroom-and-events/b...

"Please explain how you'll mutate a single bit of output given only input"

Same way Rowhammer works. Exploiting a physical vulnerability gives zero damns about encryption. Now whether you get VALID or USABLE data from the attack is an entirely different story.

Reply on news.ycombinator.com