{"id":112780,"date":"2024-01-09T21:10:14","date_gmt":"2024-01-09T19:10:14","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-realizacziyah-postkvantovogo-algoritma-shifrovaniya-kyber"},"modified":"2024-01-09T21:10:14","modified_gmt":"2024-01-09T19:10:14","slug":"uyazvimost-v-realizacziyah-postkvantovogo-algoritma-shifrovaniya-kyber","status":"publish","type":"post","link":"https:\/\/prohoster.info\/hu\/blog\/news\/uyazvimost-v-realizacziyah-postkvantovogo-algoritma-shifrovaniya-kyber","title":{"rendered":"Se bez\u00e1r\u00e1s a posztkvantum titkos\u00edt\u00e1si algoritmus, Kyber megval\u00f3s\u00edt\u00e1saiban","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

A Kyber encryption algorithm implementation, which won the competition for cryptographic algorithms resistant to attacks by quantum computers, has been found to have a vulnerability that allows attacks through side channels to recreate secret keys based on measuring the time of operations during the decryption of ciphertext provided by the attacker. The problem affects both the reference implementation of the CRYSTALS-Kyber KEM key encapsulation mechanism and many third-party encryption libraries supporting Kyber, including the pqcrypto library used in the Signal messenger. <\/p>\n

A KyberSlash k\u00f3dnev\u00e9re keresztelt sebezhet\u0151s\u00e9g l\u00e9nyege, hogy a \u00fczenet dek\u00f3dol\u00e1sa sor\u00e1n a k\u00f6vetkez\u0151 oszt\u00e1si m\u0171veletet haszn\u00e1lja: «t = (((t < 1) + KYBER_Q\/2)\/KYBER_Q) & 1;», ahol a osztand\u00f3 a titkos «t» \u00e9rt\u00e9ket tartalmazza, amely «double» t\u00edpus\u00fa, m\u00edg az oszt\u00f3 egy k\u00f6ztudottan nyilv\u00e1nos \u00e9rt\u00e9k, a KYBER_Q. A probl\u00e9ma az, hogy az oszt\u00e1si m\u0171velet ideje nem \u00e1lland\u00f3, \u00e9s k\u00fcl\u00f6nb\u00f6z\u0151 k\u00f6rnyezetekben az oszt\u00e1shoz sz\u00fcks\u00e9ges CPU ciklusok sz\u00e1ma a bemeneti adatokt\u00f3l f\u00fcgg. \u00cdgy a m\u0171veletek idej\u00e9nek v\u00e1ltoz\u00e1sa alapj\u00e1n a felhaszn\u00e1lt adatok term\u00e9szet\u00e9r\u0151l lehet inform\u00e1ci\u00f3t nyerni. <\/p>\n

Daniel Bernstein, a renowned expert in cryptography, managed to prepare a working demonstration proving the possibility of executing an attack in practice. In two of the three experiments conducted by running the code on a Raspberry Pi 2 board, it was possible to fully recreate the Kyber-512 private key based on the time measurements of data decoding. This method can also be adapted for the Kyber-768 and Kyber-1024 keys. For a successful attack, it is necessary that the ciphertext provided by the attacker be processed using the same key pair, and that the execution time of the operation can be measured accurately. <\/p>\n

N\u00e9h\u00e1ny k\u00f6nyvt\u00e1rban \u00fajabb adatsziv\u00e1rg\u00e1s (KyberSlash2) ker\u00fclt felfedez\u00e9sre, amely szint\u00e9n a titkos \u00e9rt\u00e9kek felhaszn\u00e1l\u00e1s\u00e1b\u00f3l ad\u00f3dik oszt\u00e1si m\u0171veletek sor\u00e1n. A k\u00fcl\u00f6nbs\u00e9gek az els\u0151 vari\u00e1nst\u00f3l abban \u00e1llnak, hogy a titkos\u00edt\u00e1si szakaszban (a poly_compress \u00e9s a polyvec_compress funkci\u00f3kban) t\u00f6rt\u00e9nik a h\u00edv\u00e1s, nem pedig a dek\u00f3dol\u00e1s sor\u00e1n. A m\u00e1sodik vari\u00e1ns hasznos lehet a t\u00e1mad\u00e1sok sor\u00e1n, csak abban az esetben, ha az elj\u00e1r\u00e1st \u00fajra titkos\u00edt\u00e1si m\u0171veletekben haszn\u00e1lj\u00e1k, ahol az elk\u00e9sz\u00edtett titkos sz\u00f6veg bizalmasnak sz\u00e1m\u00edt. <\/p>\n

A sebezhet\u0151s\u00e9get m\u00e1r elt\u00e1vol\u00edtott\u00e1k a k\u00f6nyvt\u00e1rakb\u00f3l: <\/p>\n