3 of 41

Summary of what this means/topics we’ll explore

Company Confidential and Proprietary

What new technique did the researchers discover?

These researchers figured out how to recover secret keys of any target device that has a power LED

How did they recover the secret keys using the power LED?

They examined the intensity and brightness of the device’s power LED since its related to its power consumption. They used recording devices like video cameras of smartphones and zoomed into the power LED to:

1. get the limited eight bit resolution of a single RGB channel which is sufficient enough to detect the differences in the power consumption caused by the cryptographic computations.
2. use the camera’s rolling shutter to upsample the sampling rate of the intensity/brightness of the power LED to the desired level needed to perform cryptanalysis.

With this, they leveraged existing side-channel attacks to extract the private keys

4 of 41

But first…what’s a side-channel attack?

5 of 41

Side-channel Attacks

By definition

A side-channel attack is any attack based on extra information that can be gathered because of the fundamental way a computer protocol or algorithm is implemented, rather than flaws in the design of the protocol or algorithm itself

What does this mean looking at?

Cache accesses
Timing
Power-monitoring
Acoustics
Optical
Software Initiated

Company Confidential and Proprietary

6 of 41

Some Examples

Meltdown
Spectre
Rowhammer
Lamphone
Keyboard Acoustics
Collide+Power
Downfall
Inception

Company Confidential and Proprietary

7 of 41

Elliptic Curve Cryptography 101

8 of 41

Let’s play pool!

Define our starting point A
A dot B = -C reflect across x axis to C
A dot C = -D reflect across x axis to D
A dot D = -E reflect across x axis to E
…
…
let’s do this N times and arrive at some final point P
Congratulations! You now have a private key and public key
public key: AP our initial and ending points
private key: N the number of hops/operations we did to arrive at this ending point.

Company Confidential and Proprietary

9 of 41

ECDSA

Elliptic Curve Digital Signature Algorithm (ECDSA) is a very popular digital signature

algorithm, used among others in the TLS protocol [Res18], document signing and in

blockchain application

Company Confidential and Proprietary

11 of 41

At a glance

In the case of ECDSA or other signature schemes with random nonces, the bit-length of the random nonces is leaked.
This is much more significant as each signature then presents new usable information on the private key. The way this information is used to recover the private key is via first converting the problem to an instance of the Hidden Number Problem and solving it via lattice reduction techniques.

Company Confidential and Proprietary

12 of 41

Minerva

There is a G the elliptic curve generator, that generates the keys, that is multiplied by some scalar nonce k that has some bit length being leaked. By taking enough samples of this leaky nonce and signatures for known messages you ultimately can figure out the private key

Company Confidential and Proprietary

13 of 41

Non-leaky bits

Company Confidential and Proprietary

14 of 41

Athena IDProtect Leaky Bits

Company Confidential and Proprietary

15 of 41

Athena IDProtect Bit Length Dependency

Company Confidential and Proprietary

16 of 41

Athena IDProtect Powertrace

Company Confidential and Proprietary

Clear dynamic bound on the number of loops in scalar multiplication is visible in a powertrace of an ECDSA signing operation.

17 of 41

Hidden Numbers and Lattices

Voneh and Venkatsen in 1996 presented a paper, Hardness of computing the most significant bits of secret keys in Diffie-Hellman and related schemes
This paper introduces a method for proving the hardness of computing the most significant bits of keys in the Diffie-Hellman scheme.
They also showed a way to solve it by transforming it into a lattice Closest Vector Problem (CVP) solvable via lattice reduction and Babai's nearest plane algorithm.

Company Confidential and Proprietary

18 of 41

Adapting the Hidden Number Problem

Company Confidential and Proprietary

19 of 41

Solving the problem with Lattices

Company Confidential and Proprietary

21 of 41

Hertzbleed Summary

Real practical side-channel relying on changes in CPU frequency

Originally demonstrated against SIKE, accomplishing full key extraction via remote timing
SIKE and SIDH were deprecated due to unrelated security concerns stemming from “An efficient key recovery attack on SIDH” by Castryck and Decru from late 2022 and originally published in 2023

Dynamic voltage and frequency scaling (DVFS)

Power management scheme of modern x86 processors
Will adjust CPU frequency based on the data being processed

When under a sustained workload will modify the steady-state frequency of the CPU
Different performance levels (P-levels)

Ex P0 state has CPU run at maximum performance

Thermal Design Point (TDP)

Expected power consumption at sustained workload

Company Confidential and Proprietary

22 of 41

Maintaining Steady-state

Company Confidential and Proprietary

23 of 41

A Quick Question

Company Confidential and Proprietary

Which of these operations are going to run faster?

Which will consume more power?

24 of 41

Hamming Distance

Company Confidential and Proprietary

25 of 41

The Vulnerability Itself

Now we see where the vulnerability is! When running sustained workloads, CPU overall performance is capped by TDP. Under modern DVFS, it maximizes its performance by oscillating between multiple P-states. At the same time, the CPU power consumption is data-dependent. Inevitably, workloads with different power consumption will lead to different CPU P-state distribution. For example, if workload w1 consumes less power than workload w2, the CPU will stay longer in lower P-state (higher frequency) when running w1.

Company Confidential and Proprietary

26 of 41

In Summary

Company Confidential and Proprietary

27 of 41

Finally…let’s recover some keys with video

28 of 41

Rolling Shutter - Overview

The rolling shutter is an image-capturing method in which

a frame of a video (in video footage) is captured by scanning

the scene vertically/horizontally. When this method is used, a

frame/picture is not actually composed of a single snapshot of

a scene taken at a specific point in time but rather is composed

of multiple snapshots taken of vertical/horizontal pieces of

the scene at different times.

With a vertical rolling shutter, a sensor’s pixels are exposed

and read out row-by-row sequentially at different times from

top to bottom (or left to right) according to a configurable

shutter speed (E) which determines the amount of time that

the sensor is exposed to light.

Because each row (or a group

of adjacent rows) in a sensor with a rolling shutter is captured

at a different time, attackers can increase the sampling rate

from the camera’s FPS rate (60/120 FPS) to the rate at which

rows are recorded, a rate which is based on the shutter speed

29 of 41

Rolling Shutter - Experimental Setup

Company Confidential and Proprietary

Upsampling the FPS rate of the video camera to the shutter rate: An Arduino’s LED flickering at 4 kHz (left) is recorded by a Samsung Galaxy S22 Ultra using a lens that increases the size of the LED so that it fills the entire screen (middle). A frame of the video recorded by the smartphone that captures the 4 kHz flickering (right)

30 of 41

Minerva Experiment - Setup

Company Confidential and Proprietary

As seen on the left, the video camera was directed at the smart card reader (indicated by the red arrow) from 16 meters away. On the right is an image of the smart card reader’s power LED

As observed in the papers presenting the

Minerva [8] and TPM-FAIL [9] attacks, many common cryp-

tographic libraries optimize the computation time of ECDSA

signing by truncating any leading zeros. This optimization

results in a variable number of loop iterations that is associated

with a variable execution time for the entire main loop,

which is determined by the number of leading zeros in the

randomly generated nonce. Thus, by measuring the signing

time, attackers can detect the number of loop iterations and

determine the number of leading zeros in the nonce k, which

can be used to extract the target’s private key using lattice

techniques, in which the signatures whose nonces have many

leading zeros are used to construct a hidden number problem

We performed the Minerva attack to recover a smart card’s

ECDSA private key by estimating the signing time of a

signature from video footage of the smart card’s power LED

(as opposed to the original applications [8, 9] of the attack

which relied on CPU measurements of the ECDSA signing

operations obtained using code installed on the target lap-

top/computer). We also demonstrate a remote attack in which

footage obtained by an Internet-connected video camera lo-

cated five meters away from the smart card reader is exploited.

We connected one of the smart card

readers to a laptop via a USB cable and inserted the Athena

IDProtect smart card into the reader. We placed a SUNBA

video camera 25X optical zoom 5MP smart security dome1

16 meters away from the smart card reader (the experimental

setup can be seen in Fig. 7). We used the Internet-connected

video camera remote API and directed the camera’s point

of view toward the power LED of the smart card reader

and zoomed in on the power LED until it filled the entire

frame (see Fig. 7). The experiment was conducted in a dark

environment (i.e., the lights in the room were turned off). We

obtained video footage (full HD resolution, 60 FPS, shutter

speed 1

500 , 8-bit resolution for a single channel) from 10,500

different ECDSA sign operations performed by the smart card

(separated by 200 ms of sleep). The 10,500 signatures were

recorded in 65 minutes over 35 different videos. Each video

lasted 1:50 minutes and consisted of 300 triggered ECDSA

signatures.

31 of 41

Minerva Experiment - Extracting Frame Series Associated with ECDSA Signatures

Top: A series of frames that started and ended during the rolling shutter’s scanning time (a Class I series). Middle: A series of frames that started during the transition time between frames (a Class II series). Bottom: A series of frames that ended during the transition time between frames (a Class II series).

e note that at the end of this process, the values of

b0, ..., bn consisted of 10,500 consecutive series of sign

separated by 10,501 consecutive series of idle as follows:

idle, idle, ..., idle, sign, sign, sign, ..., sign, idle, idle, ..., idle.

We identified the 10,500 consecutive sign series (that were

separated by the idle series), extracted their associated frames

(f 1

start, ......, f 1

end, ..., f 10,500

start , ......, f 10,500

end ), and mapped them

to their relevant signatures (ECDSA1, ...., ECDSA10,500).

For each ECDSAi signature (1 ≤ i ≤ 10, 500), the frame

series associated with it (f i

start, ......, f i

end) was analyzed, and

the signature was classified as one of two classes:

Class I:

a frame series of ECDSA signatures that started and ended

during the scanning time; such signatures can be identified

based on the switch between the blue and black colors

somewhere in the middle of the first (f i

start) and last (f i

end)

frames, as can be seen in Fig. 8; and Class II: a frame series of

ECDSA signatures that started or ended during the transition

time (which is not captured by a frame); such signatures can

be identified based on the full black color in the first (f i

start)

or last (f i

end) frameThe class of each signature ECDSAi with associated frame

series f i

start, ..., f i

end was determined by examining whether

the blue rows appear in the first (f i

start) or last (f i

end) frame.

This was done by applying the percentage function (see

Algorithm 2), calculating pf i

start = P ercentage(f i

start) and

pf i

end = P ercentage(f i

end), and testing their values using the

following conditions:

class(ECDSAi) =

class II, if pf i

start = 1.0

class II, if pf i

end = 1.0

class I, otherwise

32 of 41

Minerva Experiment - Results

A heat map of the estimated execution times of 7,826 ECDSA sign operations as a function of the number of leading zero bits in the nonce.

33 of 41

Hertzbleed Experiment - Setup

The video camera of an iPhone 13 Pro Max is directed (through a lens) at the power LED of Logitech Z120 speakers that are connected to a USB hub used to charge a Samsung Galaxy S8 (which contains the SIKE key)

We downloaded the code published

in the Hertzbleed repository [39], installed the code on the

Samsung Galaxy S8, and used it to examine whether the

time difference is observable on the smartphone. We analyzed

the Samsung Galaxy S8’s CPU’s execution time for each

decapsulation operation. In our experiments, we used the four

different SIKE-751 keys. For each key m = (ml−1, ..., m0)2,

we uniformly targeted 38 bit positions: 5, 15, 35, 45,...,375.

For each of the bit positions, we executed a series of 800

SIKE operations divided into eight iterations, where in each

iteration 100 SIKE operations were executed on 100 threads

spawned concurrently. Overall, we executed 121,600 SIKE

operations that consisted of 1,216 iterations (each of which

consists of 100 SIKE operations); eight iterations were used

to measure the execution time of each bit. In this case, the

execution time of the SIKE iterations was calculated using

CPU measurements obtained with the code downloaded from

the official Hertzbleed repository

e connected the Samsung Galaxy

S8 to a USB hub (Gold Touch 8 Ports USB3.0 Slim HUB).

We also connected USB speakers (Logitech Z120) to the USB

hub. We used the video camera of an iPhone 13 Pro Max and

zoomed it onto the power LED of the USB speakers using a

lens (see Fig. 11). We obtained video footage from the iPhone

(resolution: 1920x1080, FPS: 120, rolling shutter speed: 1

61400 )

of the power LED of the USB speakers while the Samsung

Galaxy was attacked in a series of adaptive chosen ciphertext

attacks.

34 of 41

Hertzbleed Experiment - SIKE Key Recovery

The RGB values of eight SIKE iterations extracted from a video (top). Zooming in on the green channel (bottom).

We processed each video ob-

tained as we triggered the adaptive chosenly ciphertext attack

as follows:

We applied the M inIterT ime function (see Algorithm

3) on the video footage obtained. This function calls to

Average − F rames to extract a signal for the green channel

of the video footage. An example of the signal extracted from

one of the videos is presented in Fig. 12; as can be seen in

the image presenting the green channel, the eight iterations

can be detected visually, and the indexes associated with the

beginning of the iterations can be detected based on their

values which are greater than a threshold of 205.

Next, M inIterT ime calls to Extarct−Indexes to extract

the indexes of the frames associated with the beginning of the

iterations. This is done by determining whether the values of he indexes of the frames are greater than 204.9. We note that

due to added noise, the Extarct − Indexes function may

return more than eight indexes (i.e., the function may return

additional errors). Next, M inIterT ime computes the number

of frames between every two indexes (due to the errors that

may have been added in indexes) and calculates the time of the

iterations by multiplying the number of frames by (1/fps), the

number of seconds it takes to capture a frame (including the

transition time). The function filters any result that is lower

than 36 seconds (and caused by the added errors). Finally,

M inIterT ime returns min, the shortest iteration time.

We determined the value of the i-th index of the key

according to the value of min:

35 of 41

Hertzbleed Experiment - Results

Minimum times used to extract the first 20 bits (1 to 20) and last 20 bits (358 to 377) of the SIKE key based on eight iterations.

The error detection (left) and correction (right) of bit index 33.

First, we note that we guessed that the value

of the first index of the key (where j = 0) would be zero.

According to Hertzbleed, an incorrect guess/prediction of the

value of the key in any index n (where 0 ≤ n ≤ 377)

will create 377 − n consecutive non-switch cases (i.e., no

anomalous zero will appear from this point on). In our case, we

verified that our guess for the first index was correct by using

the next bit index (where j = 1) which was predicted as a

switch case. The minimal values among the seven iterations of

the first 20 least significant bit (LSB) positions (bits 1–20) and

the last 20 most significant bit (MSB) positions (bits 358–377)

of the key we recovered are presented in Fig. 13. The 378 bits

of the key were recovered with six errors that we encountered

and corrected during the recovery process

Error Detection and Correction: We used an error

detection and correction algorithm to detect and correct the

six errors we encountered during the recovery process, based

on the error correction and detection algorithm suggested in

the original method suggested in the Hertzbleed paper [10]. In

the case of an error in the recovery of a bit with an index i, the

phenomenon that causes anomalous zeros (which is expected

to happen with a probability of 1

2 ) will not be triggered in the

subsequent bits recovered (see the Hertzbleed paper [10] for

more details). The untriggered anomalous zeros in the recovery

of the subsequent indexes will result in a non-switch case and

a longer execution time (that will cross the threshold used to

distinguish between mi = mi−1 and mi̸ = mi−1). This will

result in a chain of recovered bits with similar values (the

result of a chain of non-switches) for the subsequent indexes.

36 of 41

Ok cool…but what’s the catch?

37 of 41

Caveats

Camera distance matters!

At 60ft the lights need to be off in the room
At 6ft the lights can be on.

Time

Video needs to be captured for 65 minutes, in which the reader must constantly perform the operation

Requires an existing side-channel attack

There must be an underlying side-channel attack that leaks power consumption, timing, or other physical characteristics as the device is performing cryptographic operations

Company Confidential and Proprietary

38 of 41

Looking at the Future and Questions

These caveats seems pretty limiting, will this ever happen?
SIKE is now deprecated…why do we care?
Other questions?

Company Confidential and Proprietary

39 of 41

References

Nassi, Ben, et al. “Video-Based Cryptanalysis: Extracting Cryptographic Keys from Video Footage of a Device’s Power Led.” Cryptology ePrint Archive, 1 Jan. 1970, eprint.iacr.org/2023/923.

Jancar, Jan, et al. “Minerva: The Curse of Ecdsa Nonces.” Cryptology ePrint Archive, 1 Jan. 1970, eprint.iacr.org/2020/728.

Minerva, minerva.crocs.fi.muni.cz/. Accessed 18 Aug. 2023.

Wang, Yingchen. “Hertzbleed Explained.” The Cloudflare Blog, The Cloudflare Blog, 8 Aug. 2022, blog.cloudflare.com/hertzbleed-explained/.

“Video-Based Cryptanalysis.” Ben Nassi, www.nassiben.com/video-based-crypta. Accessed 18 Aug. 2023.

Nick Sullivan    -  Oct 24, 2013 8:07 pm UTC. “A (Relatively Easy to Understand) Primer on Elliptic Curve Cryptography.” Ars Technica, 24 Oct. 2013, arstechnica.com/information-technology/2013/10/a-relatively-easy-to-understand-primer-on-elliptic-curve-cryptography/2/.

Company Confidential and Proprietary

40 of 41

Backup Slides

41 of 41

Overview

the attacker recovers secret

keys from a target device using video footage of the power

LED of the target device (i.e., a direct attack) or of the power

LED of a connected peripheral (i.e., an indirect attack) whose

power consumption is also affected by the power consumption

of the target device. The attacker exploits the correlation

between the intensity/brightness of a device’s power LED and

the device’s power consumption (which is affected by the cryp-

tographic operations performed); this correlation stems from

the fact that i many devices, the power LED is connected

directly to the power line of the device’s electrical circuit

which lacks effective means (e.g., filters, voltage stabilizers)

of decoupling the correlation. This correlation, which can be

detected by analyzing the RGB values of the device’s power

LED in video footage, is used by the attacker to perform

cryptanalysis. In order to achieve a sampling rate that can

be used for cryptanalysis, the attacker uses the video camera’s

rolling shutter to upsample the sampling rate by filling the

iii

entire frame with the LED

Company Confidential and Proprietary

1 of 41

2 of 41

3 of 41

4 of 41

5 of 41

6 of 41

7 of 41

8 of 41

9 of 41

10 of 41

11 of 41

12 of 41

13 of 41

14 of 41

15 of 41

16 of 41

17 of 41

18 of 41

19 of 41

20 of 41

21 of 41

22 of 41

23 of 41

24 of 41

25 of 41

26 of 41

27 of 41

28 of 41

29 of 41

30 of 41

31 of 41

32 of 41

33 of 41

34 of 41

35 of 41

36 of 41

37 of 41

38 of 41

39 of 41

40 of 41

41 of 41