Stealing Smartphone Crypto Keys Using Radio Waves 37
coondoggie writes "Encryption keys on smartphones can be stolen via a technique using radio waves, says one of the world's foremost crypto experts, Paul Kocher, whose firm Cryptography Research will demonstrate the hacking stunt with several types of smartphones at the upcoming RSA Conference in San Francisco next month."
Re:Electromagnetic Where Exactly? (Score:4, Informative)
It's a pretty typical side-channel attack. It's detecting the RFI emitted during computation, and using that to determine the key. So, yes, it's detecting the waves emitted by the little electrons zipping around inside the smartphone.
Re:Van Eck side channel (Score:4, Informative)
This is not a new attack. It's been known for decades - this is the attack the NSA codenamed HIJACK, I believe (or it may possibly be NONSTOP, I always get the two confused). I know GCHQ's CESG were aware of it too.
Putting a radio transmitter next to something which may produce key-dependent interference (depending on, say, whether it's squaring (1) or multiplying (0) each bit of an RSA key) will yield a measurable interference pattern which leaks information about the keys.
Countermeasures are surprisingly similar to acoustic emissions attacks and timing attacks: blinding; routines/hardware circuits which don't exhibit key-dependent behaviour; better shielding, particularly of the ground and Vcc planes for the TX circuit.
Works for keyboards, too.
Clever. I like it. (Score:5, Informative)
So the CPU doesn't have a strong enough EM signal (note that all electronic processing generates EM waves) to send out the key processing details over any reasonable distance (tiny starting signal plus 1/r^2) . But it is a smartphone, and the CPU EM signal is strong enough to interfere with the (very!) nearby phone transmitter. And by examining that signal, you can tempest monitor the CPU from a much greater distance. Cool. The smartphone in effect has its own built in CPU EM signal amplifier.
The hard bit is the details. You need the right equipment, and the right algorithms to extract the signal and then reconstruct the key.