Get Your Hands Off My Laptop: Physical Side-Channel Key-Extraction Attacks on PCs

Abstract

We demonstrate physical side-channel attacks on a popular software implementation of RSA and ElGamal, running on laptop computers. Our attacks use novel side channels, based on the observation that the "ground" electric potential, in many computers, fluctuates in a computation-dependent way. An attacker can measure this signal by touching exposed metal on the computer's chassis with a plain wire, or even with a bare hand. The signal can also be measured at the remote end of Ethernet, VGA or USB cables. Through suitable cryptanalysis and signal processing, we have extracted 4096-bit RSA keys and 3072-bit ElGamal keys from laptops, via each of these channels, as well as via power analysis and electromagnetic probing. Despite the GHz-scale clock rate of the laptops and numerous noise sources, the full attacks require a few seconds of measurements using Medium Frequency signals (around 2 MHz), or one hour using Low Frequency signals (up to 40 kHz).

Stealing Keys from PCs Using a Radio: Cheap Electromagnetic Attacks on Windowed Exponentiation

“…Emanations of interest have been shown at the USB port [30] and through the power outlet [12]. Recently, low-bandwidth physical side-channel key-extraction attacks on PCs were demonstrated [20,21], utilizing various physical channels. These last two works presented two different lowbandwidth attacks, with different equipment and attack time requirements:…”

“…See Table 1 for a comparison. Another limitation of [20,21] is that they target the square-and-multiply algorithm. These attacks do not work for sliding-window or fixed-window exponentiation, used in most RSA and ElGamal implementations nowadays.…”

“…Similarly to [20,21], this work targets commodity laptop computers. We have tested numerous laptops of various models and makes.…”

“…1 GnuPG 2.1 (developed in parallel to GnuPG 1.x), as well as its underlying cryptographic library, libgcrypt (version 1.6.2), utilize very similar cryptographic codes and thus may also be vulnerable to our attack. Following past attacks [20,21], GnuPG uses ciphertext randomization for RSA (but not for ElGamal; see Sect. 4).…”

Fase

“…Side-channels infer secrets (e.g. cryptographic keys) by observing power consumption [8,20,25,27], sound [5,12,33], electromagnetic (EM) emanations [2,17,24], behavior under faults [9,19], and performance of shared caches [6,36,38], instruction caches, branch predictors [1], etc. Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage, and that copies bear this notice and the full citation on the first page.…”