16. What Are Side-Channel Attacks and How Can Timing Break RSA?

TL;DR

Side-channel attacks expose secrets through overlooked signals such as response timing, RF radiation, power usage, or sound. The lecture examines David Brumley and Dan Boneh’s attack on an Apache web server, which distinguished timing differences of about 1–2 microseconds across a real Ethernet network and extracted roughly 200–256 key bits. Read on to see why RSA implementation details make these tiny leaks exploitable.

Transcript

The following content is provided under a Creative Commons license. Your support will help MIT OpenCourseWare continue to offer high quality educational resources for free. To make a donation or to view additional materials from hundreds of MIT courses, visit MIT OpenCourseWare at ocw.mit.edu. PROFESSOR: All right, guys, let's get started. So today... Read More

Key Insights

• 👊 Side-channel attacks exploit unintentionally revealed information in a system.
• 👊 Timing attacks measure the time it takes for certain operations in a system, such as encryption and decryption processes.

Questions & Answers

Q: What is a side-channel attack?

A side-channel attack exploits information that a system reveals unintentionally beyond the data explicitly exchanged between its components. Examples in the lecture include timing, RF radiation, power usage, and sound.

Q: How can a timing side channel reveal a cryptographic key?

An adversary sends different input packets and measures how long the server takes to respond. Small timing variations can reveal which internal operations were faster or slower, providing information that can be used to recover key bits.

Q: What attack did David Brumley and Dan Boneh demonstrate?

They extracted a cryptographic key from a web server running Apache by measuring response times for different packets sent by an adversarial client. The attack worked over a real Ethernet network with the client and server in different places.

Q: How small were the timing differences measured in the attack?

The requests could differ in processing time by about 1–2 microseconds. Because those differences are tiny and network conditions are noisy, the researchers used careful measurements, averaging, and other techniques to distinguish them.

Q: How many key bits did the timing attack extract?

The attack extracted roughly 200–256 bits. The lecture explains that obtaining this relatively small amount of secret information was enough to break the web server’s cryptographic key.

Q: Why do many side-channel attacks target cryptographic keys or passwords?

Side channels can make it difficult to extract large amounts of data. Cryptographic keys and passwords are attractive targets because recovering a comparatively small secret can be highly useful, unlike leaking an entire database of Social Security numbers.

Q: What are examples of side channels besides network timing?

The lecture identifies RF radiation, power usage, and sound as additional side channels. It describes monitoring radiation from a teletype, observing changes in a computer’s power consumption, and identifying printed characters from a printer’s sounds.

Q: Why are RSA implementation details important to this timing attack?

The attack depends on determining when particular RSA operations execute faster or slower. Understanding how RSA key generation, encryption, and decryption are implemented therefore helps explain how those timing differences can be exploited.

Summary & Key Takeaways

• Side-channel attacks, such as timing attacks, target vulnerabilities in systems where sensitive information may be revealed unintentionally.

• The paper discusses a specific side-channel attack on RSA encryption that extracts a cryptographic key by measuring the timing of different responses.

• The attack focuses on a specific side-channel called extractor reductions, which measures the time it takes for the server to decrypt a message.