Utilize este identificador para referenciar este registo:
https://hdl.handle.net/1822/15593
Título: | Practical realisation and elimination of an ECC-related software bug attack |
Autor(es): | Brumley, B. B. Barbosa, Manuel Page, D. Vercauteren, F. |
Palavras-chave: | Cryptography Bug attack Elliptic curve OpenSSL NIST fault attack |
Data: | 2012 |
Editora: | Springer Verlag |
Revista: | Lecture Notes in Computer Science |
Resumo(s): | We analyse and exploit implementation features in OpenSSL version 0.9.8g which permit an attack against ECDH-based functionality. The attack, although more general, can recover the entire (static) private key from an associated SSL server via $633$ adaptive queries when the NIST curve P-256 is used. One can view it as a software-oriented analogue of the bug attack concept due to Biham et al. and, consequently, as the first bug attack to be successfully applied against a real-world system. In addition to the attack and a posteriori countermeasures, we show that formal verification, while rarely used at present, is a viable means of detecting the features which the attack hinges on. Based on the security implications of the attack and the extra justification posed by the possibility of intentionally incorrect implementations in collaborative software development, we conclude that applying and extending the coverage of formal verification to augment existing test strategies for OpenSSL-like software should be deemed a worthwhile, long-term challenge. |
Tipo: | Artigo em ata de conferência |
URI: | https://hdl.handle.net/1822/15593 |
ISBN: | 9783642279539 |
DOI: | 10.1007/978-3-642-27954-6_11 |
ISSN: | 0302-9743 |
Versão da editora: | http://eprint.iacr.org/2011/633 |
Arbitragem científica: | yes |
Acesso: | Acesso aberto |
Aparece nas coleções: | DI/CCTC - Relatórios Técnicos |
Ficheiros deste registo:
Ficheiro | Descrição | Tamanho | Formato | |
---|---|---|---|---|
633.pdf | Documento principal | 302,21 kB | Adobe PDF | Ver/Abrir |