{"id":112780,"date":"2024-01-09T21:10:14","date_gmt":"2024-01-09T19:10:14","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-realizacziyah-postkvantovogo-algoritma-shifrovaniya-kyber"},"modified":"2024-01-09T21:10:14","modified_gmt":"2024-01-09T19:10:14","slug":"uyazvimost-v-realizacziyah-postkvantovogo-algoritma-shifrovaniya-kyber","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/news\/uyazvimost-v-realizacziyah-postkvantovogo-algoritma-shifrovaniya-kyber","title":{"rendered":"Zranitelnost ve realizac\u00edch postkvantov\u00e9ho \u0161ifrovac\u00edho algoritmu Kyber","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

V implementaci \u0161ifrovac\u00edho algoritmu Kyber, kter\u00fd vyhr\u00e1l sout\u011b\u017e o kryptografick\u00e9 algoritmy odoln\u00e9 v\u016f\u010di kvantov\u00fdm po\u010d\u00edta\u010d\u016fm, byla odhalena zranitelnost, kter\u00e1 umo\u017e\u0148uje prov\u00e1d\u011bt \u00fatoky po bo\u010dn\u00edch kan\u00e1lech pro rekonstrukci tajn\u00fdch kl\u00ed\u010d\u016f na z\u00e1klad\u011b m\u011b\u0159en\u00ed \u010das\u016f operac\u00ed b\u011bhem de\u0161ifrov\u00e1n\u00ed \u00fato\u010dn\u00edkem poskytnut\u00e9ho \u0161ifrovan\u00e9ho textu. Probl\u00e9m se t\u00fdk\u00e1 jak referen\u010dn\u00ed implementace mechanismu zabalov\u00e1n\u00ed kl\u00ed\u010d\u016f CRYSTALS-Kyber KEM, tak mnoha dal\u0161\u00edch knihoven \u0161ifrov\u00e1n\u00ed podporuj\u00edc\u00edch Kyber, v\u010detn\u011b knihovny pqcrypto pou\u017e\u00edvan\u00e9 v messengeru Signal. <\/p>\n

Podstata zranitelnosti, kter\u00e1 byla pojmenov\u00e1na KyberSlash, spo\u010d\u00edv\u00e1 v pou\u017eit\u00ed p\u0159i dek\u00f3dov\u00e1n\u00ed zpr\u00e1vy procesu d\u011blen\u00ed «t = (((t < 1) + KYBER_Q\/2)\/KYBER_Q) & 1;», kde je d\u011blenec tajn\u00e1 hodnota «t» typu «double» a d\u011blitel je zn\u00e1m\u00e1 ve\u0159ejn\u00e1 hodnota KYBER_Q. Probl\u00e9m spo\u010d\u00edv\u00e1 v tom, \u017ee doba operace d\u011blen\u00ed nen\u00ed konstantn\u00ed a v r\u016fzn\u00fdch prost\u0159ed\u00edch z\u00e1vis\u00ed po\u010det prov\u00e1d\u011bn\u00fdch CPU cykl\u016f pro d\u011blen\u00ed na vstupn\u00edch datech. Na z\u00e1klad\u011b zm\u011bny doby operac\u00ed je tedy mo\u017en\u00e9 z\u00edskat p\u0159edstavu o povaze pou\u017e\u00edvan\u00fdch dat p\u0159i d\u011blen\u00ed. <\/p>\n

Daniel Bernstein, zn\u00e1m\u00fd odborn\u00edk v oblasti kryptografie, dok\u00e1zal p\u0159ipravit funk\u010dn\u00ed demonstraci d\u016fkazu mo\u017enosti prov\u00e9st \u00fatok v praxi. Ve dvou ze t\u0159\u00ed proveden\u00fdch experiment\u016f p\u0159i b\u011bhu k\u00f3du na desce Raspberry Pi 2 se poda\u0159ilo zcela obnovit soukrom\u00fd kl\u00ed\u010d Kyber-512 na z\u00e1klad\u011b m\u011b\u0159en\u00ed \u010dasu de\u0161ifrov\u00e1n\u00ed dat. Metoda m\u016f\u017ee b\u00fdt tak\u00e9 p\u0159izp\u016fsobena pro kl\u00ed\u010de Kyber-768 a Kyber-1024. Pro \u00fasp\u011b\u0161n\u00e9 proveden\u00ed \u00fatoku je nutn\u00e9, aby zadan\u00fd \u00fato\u010dn\u00edkem \u0161ifrovan\u00fd text byl zpracov\u00e1n pomoc\u00ed stejn\u00e9ho p\u00e1ru kl\u00ed\u010d\u016f a aby bylo mo\u017en\u00e9 p\u0159esn\u011b m\u011b\u0159it \u010das prov\u00e1d\u011bn\u00ed operace. <\/p>\n

V n\u011bkter\u00fdch knihovn\u00e1ch byla odhalena dal\u0161\u00ed chyba (KyberSlash2), kter\u00e1 tak\u00e9 vznik\u00e1 z pou\u017eit\u00ed tajn\u00e9 hodnoty p\u0159i prov\u00e1d\u011bn\u00ed d\u011blen\u00ed. Rozd\u00edly oproti prvn\u00ed variant\u011b spo\u010d\u00edvaj\u00ed ve vol\u00e1n\u00ed na f\u00e1zi \u0161ifrov\u00e1n\u00ed (ve funkc\u00edch poly_compress a polyvec_compress), a nikoli b\u011bhem de\u0161ifrov\u00e1n\u00ed. P\u0159itom druh\u00e1 varianta m\u016f\u017ee b\u00fdt u\u017eite\u010dn\u00e1 pro \u00fatok pouze v p\u0159\u00edpadech pou\u017eit\u00ed procedury v operac\u00edch op\u011btovn\u00e9ho \u0161ifrov\u00e1n\u00ed, ve kter\u00fdch je v\u00fdstup \u0161ifrovan\u00e9ho textu pova\u017eov\u00e1n za d\u016fv\u011brn\u00fd. <\/p>\n

Zranitelnost byla ji\u017e odstran\u011bna v knihovn\u00e1ch: <\/p>\n