Minerva attack can recover private keys from smart cards, cryptographic libraries

guest · Oct 3, 2019

Minerva attack can recover private keys from smart cards, cryptographic libraries
Older Athena IDProtect smart cards are impacted, along with the WolfSSL, MatrixSSL, Crypto++, Oracle SunEC, and Libgcrypt crypto libraries
October 3, 2019
https://www.zdnet.com/article/miner...eys-from-smart-cards-cryptographic-libraries/

Czech academics have detailed this week a new cryptographic attack that can recover private keys used to sign operations on some smart cards and cryptographic libraries. Once obtained, the private key can allow attackers to spoof any smart cards or sign other cryptographic operations secured by the affected libraries.
THE MINERVA ATTACK
The Minerva attack at the heart of all these issues is a classic side-channel attack. A side-channel attack is when a third-party observes leaks in cryptographic operations that, when put together, can help the attacker break the encryption scheme and reconstruct the original data.

If an attacker is able to observe or record enough cryptographic operations signed by a vulnerable smart card or by one of the vulnerable open-source cryptographic libraries, then they'll be able to compute the private encryption keys that sign these operations.
During tests, researchers said they only needed to record 11,000 operations (card swipes) from an Athena IDProtect card to obtain in private key. All this process took 30 minutes, researchers said.
Click to expand...

A RARE PRACTICAL ATTACK
On Twitter, cryptography and infrastructure engineer Tony Arcieri described the attack as "practically exploitable," meaning it can be used in the real world, rather than just being a theoretical issue, as most side-channel attacks have been.

Additional information about the Minerva attack can be found on this website, along with proof-of-concept code, a more in-depth explanation of the cryptographic attack/issue, and tools to aid testing for vulnerable cards.
Click to expand...

Log in or Sign up

Minerva attack can recover private keys from smart cards, cryptographic libraries

guest Guest

Log in or Sign up

Minerva attack can recover private keys from smart cards, cryptographic libraries

guest Guest

Useful Searches