Topic: [2014-03-06] Ars - Crypto attack could one day steal secret Bitcoin keys (Read 1064 times)

Of course, far easier would be an unscrupulous VPS admin gaining console access (which is trivial) and dumping/deleting/whatever your VPS instance. It's elementary to log input into a console terminal, or run a process that looks for a "walletpassphrase" command, or any of several dozen other attack vectors that don't involve cache or memory sniffing.

Do you trust your VPS provider?

So in short; if there is a nerdy looking scientist standing next to your computer with all kinds of probes hooked up...it's probably not a good idea to start signing 200 transactions using the same key.

So in short; if there is a nerdy looking scientist standing next to your computer with all kinds of probes hooked up...it's probably not a good idea to start signing 200 transactions using the same key.

So in short; if there is a nerdy looking scientist standing next to your computer with all kinds of probes hooked up...it's probably not a good idea to start signing 200 transactions using the same key.

Wouldn't this require the hackers have physical access to the CPU?

The Cryptology ePrint Archive provides rapid access to recent research in cryptology. Papers have been placed here by the authors and did not undergo any refereeing process other than verifying that the work seems to be within the scope of cryptology and meets some minimal acceptance criteria and publishing conditions.

The attack relies on "side channel analysis," in which attackers extract a secret decryption key based on clues leaked by electromagnetic emanations, data caches, or other manifestations of a targeted cryptographic system. In this case, cryptographers can retrieve the private key needed to take control of bitcoins by taking minute measurements of the CPU as it makes transactions using the digital currency. Specifically, by observing the last-level (L3) CPU cache of an Intel processor as it executes as few as 200 signatures, an attacker in many cases has enough data to completely reconstruct the secret key needed to take ownership. The attack exploits the way OpenSSL implements the elliptic curve digital signature algorithm (ECDSA) based on a specific curve known as secp265k1 found in Bitcoin.

"It should be noted that irrespective of the weakness in the Intel processors, cryptographic algorithms are not supposed to leak information," he wrote in an e-mail. "Hence, the fact that we can get data out of the OpenSSL implementation is a weakness in OpenSSL and should be fixed."

Indeed, experts have long recommended a Bitcoin key be used only once, but this advice is routinely ignored. Another measure is to avoid the use of Intel processors, since the attack doesn't work on modern CPUs made by AMD, Yarom said.