Side-channel attack

In December 2013, Daniel Genkin, Adi Shamir and Eran Tromer showed that a microphone placed near a laptop was enough to pull a 4,096-bit RSA key used by GnuPG in under an hour, by listening to the high-pitched noise the components made during decryption. GnuPG was patched and the demo stayed in the lab, but it shows exactly what the attack goes after. A side-channel attack ignores the algorithm and measures what its execution leaks: timing, power draw, electromagnetic emissions, sound, cache state. Paul Kocher formalized timing attacks in 1996, then differential power analysis (DPA) with Joshua Jaffe and Benjamin Jun in 1998. The idea is older: TEMPEST, a classified US program, was already dealing with electromagnetic emanations from equipment. In January 2018, Meltdown and its speculative-execution sibling (CVE-2017-5753 and CVE-2017-5715) took the topic from the lab to every fleet: speculative execution in modern processors let an attacker read, through the cache, memory that was supposed to be isolated. These attacks leave no odd packet and no suspicious process, which makes them close to invisible to detection tools. Their prime targets are smart cards and HSMs (Hardware Security Modules), which hold the master keys of banks and insurers. An extracted master key compromises every key infrastructure that depends on it, and past traffic too if it did not use ephemeral keys (forward secrecy). For a cyber insurer, the scenario is rare, severe and hard to date.