Making QUIC Quicker with NIC Offload

Software - eg the Linux kernel - can also contain vulnerability only NSA knows about.

In any case, security track record of crypto offload NICs is pretty good.

To make this vulnerable to third parties not physically in control of the hardware (in which case the PCI bus could just be sniffed for the key, or have it grabbed from RAM). Pretty much the only option is side channels.

They can't change the algorithm or other NICs that don't offload the encryption/decryption wouldn't be able to successfully decrypt it. They couldn't send "extra" packets with the key somewhere else without someone very easily detecting that anomalous traffic not being generated by the system itself.

With QUIC there are almost no-unencrypted fields by design, and those have very firm well defined meanings, so to inject steganographic hidden copies of the key in the packets themselves is infeasible. Maybe you could sneak something out by changing source ports but that's risky, and liable to be detected as well.

So that leaves side channels, which is basically only a timing channel for remote attackers in this case. At the speeds and packet throughput where hardware acceleration of the crypto matters, any buffers in the first switch and/or router that packet hits will remove the precision required for any level of intentional timing attack that could be introduced without detection.

So no it almost certainly couldn't have a vulnerability like that unless the crypto algorithms themselves are broken, in that case this whole discussion is moot as it doesn't matter if its accelerated or not.

> Fixing NIC is not as easy as fixing software

This kind of thing is frequently implemented in FPGAs which can be updated with firmware. The firmware will likely be closed source, but that hasn't stopped people before from fixing firmwares without the original manufacturers knowledge or consent.

It's a lot more work but turns out the people that would be targeted by an attack fall into two categories, those who have the financial ability to pay for a security team to handle these kinds of vulnerabilities in house (or at least mitigate them) and normal people who couldn't bear the brunt of a nation state targeting them even if this one vulnerability didn't exist.

The NSA has been caught doing some seriously shady things we all know that, and no one is going to seriously argue they've stopped trying and developing new things, but it's not even close to reasonable to assume that any paper that has "crypto" present in it is a conspiracy from the NSA or any other intelligence agency.

Okay, but I'm asking what does it look like? What kind of vulnerability? They presumably aren't using SuperDuper Secret Wifi to mirror data wirelessly to the moon, right? There are a limited number of outcomes at some point. They can't exactly change the encryption algorithms, otherwise clients fail to connect, and modern TLS (and QUIC) are designed to reduce algorithm agility in the name of preventing downgrade attacks and insecure suites. And they can't just break AES with an alien computer, because if so, why bother with the NIC at all? And again: How do they escrow the data they want out of the network, considering the extremely variable (and potentially secured, unknown, hostile) network conditions? If they can do that with some kind of host exploit or whatever, why not just take private keys in the first place? They could just snip ground cables then and be done with it, which is exactly how they got Google. (The most realistic case I can think of is somehow compromising entropy generation, perhaps.)

And finally, why do any of this when you can almost definitely just issue a gag order to a legal council, or behind-the-door threats to a foreign government agency to tow the line, or any number of things? You're dealing with governments who have immense global influence, not scrappy hackers who only have their wits and old laptops about them.

I'm not saying agencies don't have exploits, or they don't use them, or they don't spy on a lot of data, or that even some backdoors aren't real. But if you're looking a NIC offload device, immediately claim "Wiretapping", and can't actually explain how it wiretaps anything or what the attack model is, it's really just random speculation and fear mongering.

The thing is, all your said, applies to all NICs we used these days. There are nothing special in these NICs with advanced offload features.

> If that software then exfiltrated valuable info – session keys, or a digest of hotwords seen, or every string typed into targeted HTML form fields – how would you know?

How does this magical exploit work, exactly? How would it extract keywords from forms, when forms are ridiculously dynamic per-website, per user, and per form? (Many forms aren't even actually that, but text boxes that are fed directly by JavaScript event handlers into a Websocket, these days.) How do they target these groups using and installing these the NICs, and ensure they're all put in the right place? Do they literally backdoor every device that exists? No meaningful backdoors were ever found in Supermicro devices, for instance, despite immense pressure to find them. The same with session keys, what "session keys" are being compromised? Session keys exist at the TLS level, the application level, and conceptually many others. TLS keys already aren't useful for anything beyond their used connections for instance, and flow identification can vary in many ways, so how would they correlate user-to-flow in order to target attacks? If they're not doing targeted attacks, then what are they doing?

How is it going to exfiltrate that data if the NIC is on an isolated network (e.g. in some mesh topology, because it's only used intra-rack)? How do they plan for that, by exploiting the software stack? If they can exploit the software stack already, why not just compromise the host? You're telling me NSA spooks can in advance make sure your datacenter rack is organized so that RF signals can be used to wirelessly transport data on the spectrum and nobody has ever had proof of this, but they can't just, you know, write a software exploit? Issue a gag order? And that they use this capability with some regularity? If it wasn't regular, why do it in the first place when the risk of discovery is higher? How do they predict these ridiculously variable conditions in advance, and how are they not discovered? And above all, why would all this be something you immediately jump to, instead of just, say, normal infosec style attacks? You can literally buy 0days for COTS software, on the market. Your original post was motivated by fear of some Chinese person working for the Chinese government. Why? Because China is a totalitarian government but also they somehow need university students to make backdoor'd NICs, in conjunction with researchers from Europe who wouldn't, like, detect them? The ruling party controls the entire military and governs the internet and can already decrypt all connections, but they need this too?

This kind of stuff is just sci-fi/mil-tech fantasy scenarios. We can all hash out incredibly-specific ridiculous infosec attacks all day that we could pull off in a controlled environment, but that doesn't mean any of them are actually more useful or viable than others. People on this site desperately want to believe the world is filled with action movie sci-fi hacker scenarios that can just be defeated in a technical one-up kind of way, because it means the solution is purely a technical problem, rather than the real alternative: you will get thrown in a dark jail cell for 500 years without appeal if you don't comply with this order to install a backdoor directly in your datacenter.