CCS 2016: ECDSA Key Extraction from Mobile Devices via Nonintrusive Physical Side Channels

Working with researchers from the Technion and from Tel Aviv University, we show that undesired electromagnetic emanations from mobile phones allow adversaries to steal cryptographic keys from the phone. The work has been accepted to CCS 2016.

D. Genkin, L. Pachmanov, I. Pipman, E. Tromer and Y. Yarom, ECDSA Key Extraction from Mobile Devices via Nonintrusive Physical Side Channels.
Abstract: We show that elliptic-curve cryptography implementations on mobile devices are vulnerable to electromagnetic and power side-channel attacks. We demonstrate full extraction of ECDSA secret signing keys from OpenSSL and CoreBitcoin running on iOS devices, and partial key leakage from OpenSSL running on Android and from iOS’s CommonCrypto. These non-intrusive attacks use a simple magnetic probe placed in proximity to the device, or a power probe on the phone’s USB cable. They use a bandwidth of merely a few hundred kHz, and can be performed cheaply using an audio card and an improvised magnetic probe

This entry was posted in Publications, Research, Security. Bookmark the permalink.

Comments are closed.