Microprocessors from Intel, AMD and other companies contain a newly discovered weakness that remote attackers can use to obtain cryptographic keys and other classified data traveling through hardware, researchers said Tuesday.
Hardware manufacturers have long known that hackers can extract secret cryptographic data from a chip by measuring the power it consumes while processing these values. Fortunately, the means to use microprocessor-based power analysis attacks are limited, as the threat has few viable ways to remotely measure energy consumption while processing secret material. Now a team of researchers has figured out how to turn power analysis attacks into a different side channel operation class that is significantly less demanding.
Targeting DVFS
The team found that Dynamic Voltage and Frequency Scaling (DVFS) – a power and heat management feature added to any modern processor – allows attackers to detect changes in power consumption by monitoring the time it takes for the server to respond to specific carefully made inquiries. . The discovery significantly reduces what is needed. With an understanding of how DVFS works, side channel power attacks become much simpler synchronization attacks that can be performed remotely.
Researchers called their attack Hertzbleed because it uses insights into DVFS to reveal or leak data that is expected to remain confidential. The vulnerability is tracked as CVE-2022-24436 for Intel chips and CVE-2022-23823 for AMD CPU. Researchers have already shown how the exploit technique they developed can be used to retrieve an encryption key from a server running SIKE, a cryptographic algorithm used to establish a secret key between two countries through an otherwise insecure communication channel.
Advertising
The researchers said they had successfully replicated their attack on Intel’s 8th to 11th generation Core microarchitecture processors. They also claim that the technology will run on Intel Xeon processors and confirm that AMD Ryzen processors are vulnerable and allow the same SIKE attack used against Intel chips. Researchers believe that chips from other manufacturers may also be affected.
In a blog post explaining the discovery, members of the research team wrote:
Hertzbleed is a new family of side channel attacks: frequency side channels. In the worst case, these attacks can allow an attacker to retrieve cryptographic keys from remote servers that were previously thought to be secure.
Hertzbleed has benefited from our experiments, which show that in certain circumstances the dynamic frequency scaling of modern x86 processors depends on the data being processed. This means that with modern processors, the same program can run at a different CPU frequency (and therefore take different time on the wall) when calculating, for example, 2022 + 23823 compared to 2022 + 24436.
Hertzbleed is a real and practical threat to the security of cryptographic software. We demonstrated how a smart attacker can use a new ciphertext attack against SIKE to perform a full key retrieval remotely, even though SIKE is used as “permanent time”.
Meanwhile, Jerry Bryant, senior director of security communications and incident response at Intel, challenged the practicality of the technique. He wrote in a publication: “Although this issue is interesting from the point of view of research, we do not believe that this attack is practical outside the laboratory environment. Also keep in mind that cryptographic implementations that are hardened against side channel power attacks are not vulnerable to this issue. ”Intel has also released guidelines for hardware and software vendors here.
Neither Intel nor AMD is releasing microcode updates to change the behavior of the chips. Instead, they endorse the changes made by Microsoft and Cloudflare to their PQCrypto-SIDH and CIRCL cryptographic libraries, respectively. The researchers estimated that mitigation added overcapsulation costs of 5 percent for CIRCL and 11 percent for PQCrypto-SIDH. The relief was suggested by a different team of researchers who independently found the same weakness.
AMD declined to comment before a coordinated disclosure embargo was lifted.
Add Comment