#constant-time — Public Fediverse posts

Security is hard.

The TL;DR is: Do not lose possesion of your private key.

Addendum: This is from a year ago to be clear. But, there are many people that have older Yubikeys that Can Not be fixed.

https://ninjalab.io/eucleak/

The attack requires physical access to the secure element (few local electromagnetic side-channel acquisitions, i.e. few minutes, are enough) in order to extract the ECDSA secret key. In the case of the FIDO protocol, this allows to create a clone of the FIDO device.

All YubiKey 5 Series (with firmware version below 5.7) are impacted by the attack and in fact all Infineon security microcontrollers (including TPMs) that run the Infineon cryptographic library (as far as we know, any existing version) are vulnerable to the attack.

https://www.yubico.com/support/security-advisories/ysa-2024-03/

#2FA #SideChannel #ConstantTime

While this is a low threat, it could have been defended against at basically no cost.

hXXps://research.kudelskisecurity.com/2017/01/16/when-constant-time-source-may-not-save-you/

https://arstechnica.com/security/2024/09/yubikeys-are-vulnerable-to-cloning-attacks-thanks-to-newly-discovered-side-channel/

#CryptoGraphy #ConstantTime

RT @[email protected]

We share with you the first implementation of the SIDH-PoK from De Feo-Dobson-Galbraith-Zobernig. Additionally, we implement a signature scheme based on that PoK. #ConstantTime #CLanguage #Isogenies
Joint work with @[email protected] and #LucasPandolfoPerin https://twitter.com/IACR_News/status/1517942915053539328

🐦🔗: https://twitter.com/Jebus_dguez/status/1518470491698249728