{"id":119725,"date":"2024-09-06T15:43:01","date_gmt":"2024-09-06T13:43:02","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/ataka-eucleak-pozvolyayushhaya-klonirovat-yubikey-5-i-drugie-klyuchi-na-chipah-infineon"},"modified":"2024-09-06T15:43:01","modified_gmt":"2024-09-06T13:43:02","slug":"ataka-eucleak-pozvolyayushhaya-klonirovat-yubikey-5-i-drugie-klyuchi-na-chipah-infineon","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/ataka-eucleak-pozvolyayushhaya-klonirovat-yubikey-5-i-drugie-klyuchi-na-chipah-infineon","title":{"rendered":"The EUCLEAK attack, which allows cloning YubiKey 5 and other keys on Infineon chips","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Security researchers from NinjaLab have developed a side-channel attack technique that allows the cloning of ECDSA keys stored in YubiKey 5 cryptographic tokens and other devices that use Infineon's cryptographic library. The attack has been codenamed EUCLEAK and can be applied to many other systems with Infineon microcontrollers, including Infineon Optiga Trust M and Infineon Optiga TPM chips, in addition to tokens with Infineon SLE78 chips like YubiKey 5. <\/p>\n

The ability to execute the attack has been confirmed in practice for YubiKey 5Ci keys and TPMs on SLB96xx chips, while for other devices it remains theoretical. In YubiKey 5 keys, the vulnerability has been addressed in firmware version 5.7 by replacing the cryptographic library (this fix only applies to new devices because older YubiKey models do not support firmware updates). Patches have been developed for the Infineon library to address the vulnerability, but they have not yet been deployed as they have not passed certification. <\/p>\n

In addition to YubiKey 5, the issue potentially affects TPM chips (Trusted Platform Module) in Lenovo, Dell, and HP laptops, isolated enclaves in Samsung and OnePlus smartphones, hardware crypto wallets, smart cards, SIM cards, EMV chips in credit cards, as well as electronic passport chips used in China, India, Brazil, the USA, and several other Asian and European countries. <\/p>\n

The danger of key cloning is mitigated by the conditions and complexity of executing an attack \u2014 the attacker must gain physical access to the key and disassemble it, removing the plastic casing and shielding cover. After such manipulation, the casing can be restored using a 3D printer, but making the key modifications undetectable is quite challenging. Scanning the key takes several minutes, but about an hour is needed for careful disassembly and creating a new casing. After scanning, the device can be returned to the owner, but reconstructing the private ECDSA key based on the acquired data requires approximately 24 hours of computation (it is noted that the process can be reduced to one hour by automating manual operations and making optimizations).

\"The<\/center> <\/p>\n

In addition to physical access to the key, an attacker needs to somehow obtain the username and password for the service that uses the hardware key for additional authentication with multi-factor authentication. In cases where passwordless authentication methods such as FIDO2 Passwordless or Passkey are used, the attacker must also reproduce a unique biometric factor (for example, a fingerprint). <\/p>\n

The attack method involves reconstructing the ECDSA keys stored in the token based on data obtained through the analysis of the electromagnetic signal emitted by the token during the formation of digital signatures, which correlates with information about the ephemeral ECDSA key. This information is sufficient to recover the secret key using machine learning methods. For YubiKey, to initiate operations involving digital signatures, one must know the username and password for one of the services where the token is used as an additional authentication factor. <\/p>\n

The issue arises from the use of an insecure algorithm for calculating the modular inverse in the Infineon library, where the computation time depends on the input values (different vectors exhibit different computation times for the modular inverse). This characteristic allows information about individual bits to be extracted during the execution of operations with the initialization vector based on signal analysis. In the case of ECDSA, determining even a few bits containing information about the initialization vector (nonce) is enough to conduct an attack that sequentially recovers the entire private key. To successfully recreate the key, it's necessary to intercept activity during the generation of approximately 40 digital signatures. <\/p>\n

To analyze electromagnetic radiation during the generation of digital signatures, professional equipment costing over $10,000 is required. For example, during the attack, researchers used the Langer ICR HH 500-6 measurement system ($2300), applied for testing chips for electromagnetic compatibility, the Langer BT 706 amplifier, the Thorlabs PT3\/M micromanipulator ($1000) with a resolution of 10 \u00b5m, the Dino-Lite AM4113TL digital microscope ($450), and the PicoScope 6424E four-channel oscilloscope ($7500) with an 8-bit ADC resolution.

\"The<\/center> <\/p>\n

The attack scenario on YubiKey 5 tokens consists of the following steps: <\/p>\n