Improving Brumley and Boneh timing attack on unprotected SSL implementations

Abstract

Since the remarkable work of Kocher [7], several papers considering different types of timing attacks have been published. In 2003, Brumley and Boneh presented a timing attack on unprotected OpenSSL implementations [2]. In this paper, we improve the efficiency of their attack by a factor of more than 10. We exploit the timing behavior of Montgomery multiplications in the table initialization phase, which allows us to increase the number of multiplications that provide useful information to reveal one of the prime factors of RSA moduli. We also present other improvements, which can be applied to the attack in [2].

Practical Timing Side Channel Attacks against Kernel Space ASLR

“…Timing and side channel attacks are well-know concepts in computer security and have been used to attack many kinds of systems, among others cryptographic implementations [41]- [43], OpenSSL [44], [45], SSH sessions [46], web applications [47], [48], encrypted VoIP streams [49], [50], and virtual machine environments [51]- [53].…”

A Qualitative Security Analysis of a New Class of 3-D Integrated Crypto Co-processors

“…Researchers showed that such an attack could compromise remote systems over a network, which is very different from performing sidechannel attacks on smart cards that are in the attacker's possession. Improvements to the original remote timing attack made it even more practical [3].…”

A tool for static detection of timing channels in Java

“…For the attacks against modular exponentiation with Montgomery multiplication [12,25,10,5], the cause of the timing channel is the extra modular reduction step that is necessary if an intermediate result is bigger than the modulus, and which is a subtraction in one branch of a conditional. The attacks against RSA in OpenSSL [10,5] as additional cause for the timing channel have the choice of the multiplication-algorithm, namely, Karatsuba in the case of equally-sized multiplicands. The attack against modular multiplication by the Blakley's algorithm [8] is also caused by an extra modular reduction in the case of an intermediate value bigger than the modulus.…”

“…Since then, they have been practically demonstrated [10], optimized [26], and evaluated [28]. A significant part [17,16,12,25,10,5,8,15,30,27,29] of timing attacks reported in the literature exploits the difference in the running time of crypto-algorithms' implementations which is caused by conditional branches or loops where conditions depend on the attacked secrets.…”