Stealing keys from PCs using a radio: cheap electromagnetic attacks

Often this sort of leakage comes down to timing, you can infer what a person is doing by the amount of time it takes you to do something. In the simplest example (and only slightly related to the linked article), imagine we have an API end point that allows you to log in using a password. A naive implementation of authentication might look like this:

    if ( password = "hunter2" ): 
        return True

This in a lot of cases will be vulnerable to a timing attack. If the user submits the password "huntducks" it will take the function momentarily longer to return than if they had submitted "whalehorn", due to the underlying comparison exiting at the first non-match. With a bit of trial and error they can deduce the password one character at a time by altering their guess to take longer and longer to execute. To avoid this security sensitive code needs to be time constant, which is a lot harder than you'd imagine.

Attacks like the author are performing are a lot more complicated and use tricks like coercing the victim into signing distinctive plaintexts, but the example also works for more complex systems like ECDSA where people can derive the signing key by just knowing how long it took.

This is a chosen ciphertext attack, so yes, you have to decrypt the attacker-provided payload.

That being the case, there are a lot of systems where that is easy to achieve. If you have GPG in your mail client, it will decrypt anything anybody sends you.

Another thing to keep in mind is that attacks always get better, they never get worse. So today's chosen ciphertext attack is tomorrow's zero-knowledge attack.

yep, remember when we used to "air-gap" computers for safety?

You may be interested in this episode of The Amp Hour podcast, where they talk about powerline analysis attacks: http://www.theamphour.com/239-an-interview-with-colin-oflynn....

In general, it is like many other side channel attacks, where you can use the data to put constraints on the search space for a brute force attack.

I'm a bit confused. The paper states:

"We have disclosed our attack to GnuPG developers under CVE-2014-3591, suggested suitable countermeasures, and worked with the developers to test them. GnuPG 1.4.19 and Libgcrypt 1.6.3 (which underlies GnuPG 2.x), containing these countermeasures and resistant to the key-extraction attack described here, were released concurrently with the first public posting of these results."

Basically that Libcrypt 1.6.3 underlies GnuPG 2.x. But when I check my system:

foo@bar:~$ gpg2 --version gpg (GnuPG) 2.0.22 libgcrypt 1.5.3

So I'm wondering why GnuPG 2.0.22 isn't using Libgcrypt 1.6.x?

I can see from your reference that I can upgrade to Libgcrypt 1.6.x but that it requires a rebuild of GnuPG, which I'd rather not deal with right now.

If the same message (or similarly known messages) were decrypted in serial, the pattern could be quickly separated from the noise.

That increases the noise floor, yes. However that does not stop the attack, it merely makes it more complicated (and probably taking more time)

I thought it was the monitor itself, rather than the cable, that leaked enough EM radiation to reconstruct images.

Also: do LCD monitor leak so that someone can recreate the image on them some distance away?

TEMPEST is the security standard for Emanation Security (EMSEC). They keep most of the details classified because they use emanation attacks in the field and they don't want shielding spreading too far. Yet, you can see what these systems look like on the web sites:

List of certified companies https://www.nsa.gov/applications/ia/tempest/tempestPOCsCerti...

CIS Secure Computing TEMPEST gear http://cissecure.com/products/

Advanced Programs Inc TEMPEST gear http://advprograms.com/

I realize that you're joking, but RF penetrates many materials. Unless you have a lead desk then you should be checking underneath before sending state secrets. :-)

IIRC what it does is add some (tiny amount of) jitter to the clock signal; what this does is to "flatten" the spectrum of the emitted signal slightly (because instead of having a peak at 1GHz, let's say, it's going to be spread around, but centered on that frequency)

My understanding is that light doesn't interact with electromagnetic fields, so you couldn't use a laser to detect electromagnetic fields.

Consider a physics class to learn about electricity and magnetism.

It's not impossible:

http://www.technologyreview.com/view/517336/physicists-detec...

Lasers have been used for 50+ years in the intelligence community to eavesdrop on voice conversations.

https://en.wikipedia.org/wiki/Laser_microphone

You're probably thinking of a directed antenna, something like the BlueSniper rifle that was all the news like 10 years ago...

Everyone with updated software is safe from these attacks since the authors disclosed them to the effected software beforehand.

As for smartcards there is no reason to assume they would do anything to mitigate this.

Having been through FCC testing, I can confidently say that the MacBook's case, and really any metal, consumer computer case, will do very little to help. EM radiation will leak through any gaps you have in that metal, and leak out any cables you have plugged into the machine that aren't also caged. For example: the power cable, USB cables, display cable, etc.

Now if you'll excuse me, I'm going to crawl into a ball and cry away the FCC testing tears.