English (United Kingdom)

https://curated-unify.zendy.io/wp-json/zendy-region/v1/featured_content/oa?rat=en

https://curated-unify.zendy.io/wp-json/zendy-region/v1/highlighted_journal/

Global: Zendy Plus annual

Presents the access of premium content as premium feature

Premium Content

Presents the keyphrase highlighting as premium feature

Keyphrase Highlighting

Presents the summarisation as premium feature

Summarisation

Insights

Presents the pdf analysis as premium feature

PDF Analysis

Presents the zaia usage as premium feature

ZAIA

Global: Zendy Plus monthly

Global: Zendy Tools annual

Global: Zendy Tools monthly

Global: Zendy Free Plan

Trusted Platform Module (TPM) serves as a hardware-based root of trust thatprotects cryptographic keys from privileged system and physical adversaries. Inthis work, we perform a black-box timing analysis of TPM 2.0 devices deployedon commodity computers. Our analysis reveals that some of these devices featuresecret-dependent execution times during signature generation based on ellipticcurves. In particular, we discovered timing leakage on an Intel firmware-basedTPM as well as a hardware TPM. We show how this information allows an attackerto apply lattice techniques to recover 256-bit private keys for ECDSA andECSchnorr signatures. On Intel fTPM, our key recovery succeeds after about1,300 observations and in less than two minutes. Similarly, we extract theprivate ECDSA key from a hardware TPM manufactured by STMicroelectronics, whichis certified at Common Criteria (CC) EAL 4+, after fewer than 40,000observations. We further highlight the impact of these vulnerabilities bydemonstrating a remote attack against a StrongSwan IPsec VPN that uses a TPM togenerate the digital signatures for authentication. In this attack, the remoteclient recovers the server's private authentication key by timing only 45,000authentication handshakes via a network connection.  The vulnerabilities we have uncovered emphasize the difficulty of correctlyimplementing known constant-time techniques, and show the importance ofevolutionary testing and transparent evaluation of cryptographicimplementations. Even certified devices that claim resistance against attacksrequire additional scrutiny by the community and industry, as we learn moreabout these attacks.

TPM-FAIL: TPM meets Timing and Lattice Attacks