AES-256 Encryption Keys Cracked Wirelessly Using Inexpensive Kit
Dutch researchers have demonstrated that secret AES encryption keys can be extracted using recording equipment that costs under 200 euros
Researchers have demonstrated that attacks that glean sensitive information from computer systems by monitoring the electromagnetic signals they produce can now be carried out with equipment costing as little as 200 euros (£176).
Dutch security firm Fox-IT said it had successfully extracted secret AES-256 encryption keys from a distance of up to one metre using kit that could fit into a jacket pocket.
Side-channel attack
Such side-channel attacks have been widely known for some time, but in the past have required unrestricted physical access to the target system.
Fox-IT said its demonstration marks the first time such an attack has been possible from a distance, due to improvements in antenna and signal processing technology.
The technology used included a simple loop antenna, an external amplifier and bandpass filters bought from an electronics shop and a 20-euro software-defined radio USB dongle.
The kit was used to record the electromagnetic signals generated by a SmartFusion2-powered system with an AES operation running on its ARM Cortex-M3 core.
The setup recorded signals leaking from the AHB bus linking the ARM core and the on-chip memory, showing different levels of power consumption during the stages of the operation.
Key cracked
Running a different encryption operation on a parallel test system allowed the researchers to correlate the chip’s power consumption to individual bytes of information, so that they could single out 256 possible values for each of the key’s 32 bytes, down from 2256 for a pure brute-force attack.
That meant the entire key could be guessed in only 50 seconds for signals recorded at 30 centimetres.
“In contrast, a direct brute-force attack on AES-256 would require 2,256 guesses (per byte) and would not complete before the end of the universe,” the researchers wrote.
The time needed rose to five minutes for data recorded at 1 metre, but the firm said the speed and range would be improved with the use of more expensive equipment.
Real-world conditions
“This is not a game exclusively for nation states, but also anyone with pocket money and some free time,” Fox-IT said in its study. “This again underscores the need for deep expertise and defense-in-depth when designing high assurance systems.”
The company said the attack outlined was possible at 30 centimetres under realistic conditions, while the longer-range effort was successful only in a laboratory environment, where it wasn’t necessary to filter out other signals that might interfere with capturing the necessary data.
“This research… investigates attack techniques under conditions close to real world environments,” the company said. “This knowledge can be used to offer products with improved countermeasures, above and beyond any aging standards.”
Put your knowledge of artificial intelligence (AI) to the test. Try our quiz!
