Scientist-devised crypto attack

[Liquid]

http://arstechnica.com/security/2014/03/scientist-devised-crypto-attack-could-one-day-steal-secret-bitcoin-keys/

http://eprint.iacr.org/2014/161.pdf

[1715153917]

1715153917

[1715153917]

1715153917

[1715153917]

1715153917

[Blinken]

LOL side channel.

Yeah, I am cracking your computer by measuring the temperature fluctuations outside your house.

[Liquid]

So is this legit ?

[grifferz]

So is this legit ?

Yes, but once an attacker has that level of access to your hardware all bets are off and for most people, bitcoin loss would be the least of their worries. Of course, big bitcoin holders might be targeted more, but really once an attacker is this close there are any number of other attacks that would be more practical.

[Liquid]

So is this legit ?

Yes, but once an attacker has that level of access to your hardware all bets are off and for most people, bitcoin loss would be the least of their worries. Of course, big bitcoin holders might be targeted more, but really once an attacker is this close there are any number of other attacks that would be more practical.

So your saying he would have to be in the same room ?

[amspir]

So your saying he would have to be in the same room ?

The risk is that if a private key to one or more addresses is reused on a shared machine, such as in cloud computing, it is possible to determine the private key.  The researchers were able to determine the private key after 200 signings.

I would think that using disposable addresses where a private key is used to sign a transaction only once, should minimize or eliminate the risk.

[FeedbackLoop]

The risk is that if a private key to one or more addresses is reused on a shared machine, such as in cloud computing, it is possible to determine the private key.  The researchers were able to determine the private key after 200 signings.

Assuming, of course, that all the electro-magnetic signal of sufficient machines in the cloud are under permanent laboratory observation with instruments carefully specified for each individual machine construction until the investigators manage to detect, attribute to the correct public key hash, and do all the necessary measurements on the 200 signings.  


I'll also note that, from the article, this is an OpenSSL (presumably temporary) weakness. Not Bitcoin's.
 

[Boris-The-Blade]

Just have to assume anything is possible these days.

[MysteryMiner]

So is this legit ?

Yes, but once an attacker has that level of access to your hardware all bets are off and for most people, bitcoin loss would be the least of their worries. Of course, big bitcoin holders might be targeted more, but really once an attacker is this close there are any number of other attacks that would be more practical.

So your saying he would have to be in the same room ?

Even closer. He wold have to run code on the same CPU.

So your saying he would have to be in the same room ?

The risk is that if a private key to one or more addresses is reused on a shared machine, such as in cloud computing, it is possible to determine the private key.  The researchers were able to determine the private key after 200 signings.

I would think that using disposable addresses where a private key is used to sign a transaction only once, should minimize or eliminate the risk.

Never ever use shared computer or cloud computing for anything. 95% of attack vectors closed.

[ThirdRenaissance]

Is it theoretically possible to protect algorithms from side channel attacks by obfuscating their inner workings and fudging whatever signals they radiate?

[amspir]

Is it theoretically possible to protect algorithms from side channel attacks by obfuscating their inner workings and fudging whatever signals they radiate?

Most likely a future update to OpenSSL

[leckey]

Isn't it really just a flaw with Intel chips, rather than OpenSSL?

[Taras]

 It has to be efficient, they're SCIENTISTS!