{"id":38635,"date":"2019-10-31T22:24:58","date_gmt":"2019-10-31T19:24:58","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novaya-tehnika-ataki-po-storonnim-kanalam-pozvolyayushhaya-vosstanovit-klyuchi-ecdsa\/"},"modified":"2019-10-31T22:24:58","modified_gmt":"2019-10-31T19:24:58","slug":"novaya-tehnika-ataki-po-storonnim-kanalam-pozvolyayushhaya-vosstanovit-klyuchi-ecdsa","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/news\/novaya-tehnika-ataki-po-storonnim-kanalam-pozvolyayushhaya-vosstanovit-klyuchi-ecdsa","title":{"rendered":"Nj\u00eb teknik\u00eb e re sulmi p\u00ebr kanale an\u00ebsore, e cila lejon rikuperimin e \u00e7el\u00ebsave ECDSA","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Hulumtuesit nga Universiteti Masarikut zbuluan<\/a><\/noindex> t\u00eb dh\u00ebna p\u00ebr dob\u00ebsi<\/a><\/noindex> n\u00eb realizime t\u00eb ndryshme t\u00eb algoritmit p\u00ebr krijimin e n\u00ebnshkrimit digjital ECDSA\/EdDSA, duke lejuar rikuperimin e vler\u00ebs s\u00eb \u00e7el\u00ebsit privat n\u00eb baz\u00eb t\u00eb analiz\u00ebs s\u00eb rrjedhjeve t\u00eb t\u00eb dh\u00ebnave p\u00ebr bitet e ve\u00e7anta q\u00eb shfaqen gjat\u00eb p\u00ebrdorimit t\u00eb metodave t\u00eb analiz\u00ebs p\u00ebr kanale an\u00ebsore. Dob\u00ebsit\u00eb mor\u00ebn emrin kodor Minerva. <\/p>\n

Projektet m\u00eb t\u00eb njohura q\u00eb preken nga metoda e sugjeruar e sulmit jan\u00eb OpenJDK\/OracleJDK (CVE-2019-2894) dhe biblioteka Libgcrypt<\/a><\/noindex> (CVE-2019-13627), e p\u00ebrdorur n\u00eb GnuPG. Problemi \u00ebsht\u00eb i ndjesh\u00ebm gjithashtu p\u00ebr MatrixSSL<\/a><\/noindex>, Crypto++<\/a><\/noindex>, wolfCrypt<\/a><\/noindex>, elliptic<\/a><\/noindex>, jsrsasign<\/a><\/noindex>, python-ecdsa<\/a><\/noindex>, ruby_ecdsa<\/a><\/noindex>, fastecdsa<\/a><\/noindex>, easy-ecc<\/a><\/noindex> dhe kartat inteligjente Athena IDProtect. Nuk jan\u00eb testuar, por si potencialisht t\u00eb ndjesh\u00ebm jan\u00eb gjithashtu deklaruar kartat Valid S\/A IDflex V, SafeNet eToken 4300 dhe TecSec Armored Card, t\u00eb cilat p\u00ebrdorin modul ECDSA standard. <\/p>\n

Problemi tashm\u00eb \u00ebsht\u00eb zgjidhur n\u00eb versionet libgcrypt 1.8.5 dhe wolfCrypt 4.1.0, projektet e tjera ende nuk kan\u00eb formuar p\u00ebrdit\u00ebsime. Mund t\u00eb ndiqni zgjidhjen e dob\u00ebsis\u00eb n\u00eb paket\u00ebn libgcrypt n\u00eb distribuimet n\u00eb k\u00ebto faqe: Debian<\/a><\/noindex>, Ubuntu<\/a><\/noindex>, RHEL<\/a><\/noindex>, Fedora<\/a><\/noindex>, openSUSE\/SUSE<\/a><\/noindex>, FreeBSD<\/a><\/noindex>, Arch<\/a><\/noindex>.<\/p>\n

Dob\u00ebsit\u00eb t\u00eb ndjesh\u00ebm ndaj problemit<\/a><\/noindex> OpenSSL, Botan, mbedTLS dhe BoringSSL. Ende nuk jan\u00eb testuar Mozilla NSS, LibreSSL, Nettle, BearSSL, cryptlib, OpenSSL n\u00eb modalitetin FIPS, Microsoft .NET crypto,
\nlibkcapi nga b\u00ebrthama Linux, Sodium dhe GnuTLS.<\/p>\n

Problemi shkaktohet nga mund\u00ebsia e p\u00ebrcaktimit t\u00eb vlerave t\u00eb bit\u00ebve t\u00eb ve\u00e7ant\u00eb gjat\u00eb shumimit me nj\u00eb skalar n\u00eb operacione me kurba eliptike. P\u00ebr t\u00eb nxjerr\u00eb informacionin mbi bit\u00ebt p\u00ebrdoren metoda t\u00eb t\u00ebrthorta, si vler\u00ebsimi i vones\u00ebs gjat\u00eb realizimit t\u00eb llogaritjeve. P\u00ebr sulmin k\u00ebrkohet akses i pa privilegjuar n\u00eb hostin ku realizohet gjenerimi i n\u00ebnshkrimit digjital (nuk shk exclusion<\/a><\/noindex> as sulmi n\u00eb distanc\u00eb, por \u00ebsht\u00eb shum\u00eb i komplikuar dhe k\u00ebrkon nj\u00eb volum t\u00eb madh t\u00eb dh\u00ebnash p\u00ebr analiz\u00eb, prandaj mund t\u00eb mendohet si i pamundur). P\u00ebr t\u00eb shkarkuar \u00ebsht\u00eb n\u00eb dispozicion<\/a><\/noindex> mjetet e p\u00ebrdorura p\u00ebr sulmin.<\/p>\n

Megjith\u00ebse ndjeshm\u00ebria e rrjedhjes \u00ebsht\u00eb e vog\u00ebl, p\u00ebr definimin e ECDSA-s\u00eb, disa bit\u00eb me informacion rreth vektorit t\u00eb inicializimit (nonce) jan\u00eb t\u00eb mjaftueshme p\u00ebr t\u00eb kryer nj\u00eb sulm t\u00eb rim\u00ebk\u00ebmbjes se \u00e7el\u00ebsit sekret. Sipas autor\u00ebve t\u00eb metod\u00ebs, p\u00ebr t\u00eb rikuperuar me sukses \u00e7el\u00ebsin, mjafton analiza e disa qindra deri n\u00eb disa mij\u00ebra n\u00ebnshkrimesh digjitale, t\u00eb gjeneruara p\u00ebr mesazhe t\u00eb njohura p\u00ebr sulmuesin. P\u00ebr shembull, p\u00ebr t\u00eb gjetur \u00e7el\u00ebsin e fsheht\u00eb t\u00eb p\u00ebrdorur n\u00eb kart\u00ebn e men\u00e7ur Athena IDProtect mbi baz\u00ebn e \u00e7ipit Inside Secure AT90SC, duke p\u00ebrdorur kurb\u00ebn eliptike secp256r1, u analizuan 11 mij\u00eb n\u00ebnshkrime digjitale. Koha totale e sulmit ishte 30 minuta.<\/p>\n

<\/a><\/noindex><\/p>\n

Burimi: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 \u0438\u043c. \u041c\u0430\u0441\u0430\u0440\u0438\u043a\u0430 \u0440\u0430\u0441\u043a\u0440\u044b\u043b\u0438 \u0441\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u043e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u0445 \u0432 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044f\u0445 \u0430\u043b\u0433\u043e\u0440\u0438\u0442\u043c\u0430 \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u044f \u0446\u0438\u0444\u0440\u043e\u0432\u043e\u0439 \u043f\u043e\u0434\u043f\u0438\u0441\u0438 ECDSA\/EdDSA, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0445 \u0432\u043e\u0441\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u044c \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u0435 \u043f\u0440\u0438\u0432\u0430\u0442\u043d\u043e\u0433\u043e \u043a\u043b\u044e\u0447\u0430 \u043d\u0430 \u043e\u0441\u043d\u043e\u0432\u0435 \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u0443\u0442\u0435\u0447\u0435\u043a \u0441\u0432\u0435\u0434\u0435\u043d\u0438\u0439 \u043e\u0431 \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u044b\u0445 \u0431\u0438\u0442\u0430\u0445, \u0432\u0441\u043f\u043b\u044b\u0432\u0430\u044e\u0449\u0438\u0445 \u043f\u0440\u0438 \u043f\u0440\u0438\u043c\u0435\u043d\u0435\u043d\u0438\u0438 \u043c\u0435\u0442\u043e\u0434\u043e\u0432 \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u043f\u043e \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0438\u043c \u043a\u0430\u043d\u0430\u043b\u0430\u043c. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0438 \u043a\u043e\u0434\u043e\u0432\u043e\u0435 \u0438\u043c\u044f Minerva. \u041d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u043c\u0438 \u043f\u0440\u043e\u0435\u043a\u0442\u0430\u043c\u0438, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u043f\u0440\u0435\u0434\u043b\u043e\u0436\u0435\u043d\u043d\u044b\u0439 \u043c\u0435\u0442\u043e\u0434 \u0430\u0442\u0430\u043a\u0438, \u044f\u0432\u043b\u044f\u044e\u0442\u0441\u044f OpenJDK\/OracleJDK (CVE-2019-2894) \u0438 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-38635","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Teknika e re e sulmit p\u00ebrmes kanaleve an\u00ebsore, q\u00eb lejon rikuperimin e \u00e7el\u00ebsave ECDSA | ProHoster","description":"K\u00ebrkuesit nga universiteti i tij.","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/news\/novaya-tehnika-ataki-po-storonnim-kanalam-pozvolyayushhaya-vosstanovit-klyuchi-ecdsa","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041d\u043e\u0432\u0430\u044f \u0442\u0435\u0445\u043d\u0438\u043a\u0430 \u0430\u0442\u0430\u043a\u0438 \u043f\u043e \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0438\u043c \u043a\u0430\u043d\u0430\u043b\u0430\u043c, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u043e\u0441\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u044c \u043a\u043b\u044e\u0447\u0438 ECDSA | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 \u0438\u043c.","og:url":"https:\/\/prohoster.info\/sq\/blog\/news\/novaya-tehnika-ataki-po-storonnim-kanalam-pozvolyayushhaya-vosstanovit-klyuchi-ecdsa","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:24:58+00:00","article:modified_time":"2019-10-31T19:24:58+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"38635","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 22:51:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 01:06:23","updated":"2026-01-23 22:51:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/38635","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=38635"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/38635\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=38635"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=38635"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=38635"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}