{"id":38635,"date":"2019-10-31T22:24:58","date_gmt":"2019-10-31T19:24:58","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novaya-tehnika-ataki-po-storonnim-kanalam-pozvolyayushhaya-vosstanovit-klyuchi-ecdsa\/"},"modified":"2019-10-31T22:24:58","modified_gmt":"2019-10-31T19:24:58","slug":"novaya-tehnika-ataki-po-storonnim-kanalam-pozvolyayushhaya-vosstanovit-klyuchi-ecdsa","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/novaya-tehnika-ataki-po-storonnim-kanalam-pozvolyayushhaya-vosstanovit-klyuchi-ecdsa","title":{"rendered":"Nj\u00eb teknike e re sulmi p\u00ebrmes kanaleve an\u00ebsore, e cila lejon rivendosjen e \u00e7el\u00ebsave ECDSA","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Hulumtuesit nga universiteti i Masarikut zbuluan<\/a><\/noindex> informacion mbi dob\u00ebsit\u00eb<\/a><\/noindex> n\u00eb realizime t\u00eb ndryshme t\u00eb algoritmit p\u00ebr krijimin e n\u00ebnshkrimit digjital ECDSA\/EdDSA, q\u00eb mund\u00ebsojn\u00eb rikthimin e vler\u00ebs s\u00eb \u00e7el\u00ebsit privat mbi baz\u00ebn e analiz\u00ebs s\u00eb rrjedhjeve t\u00eb informacionit p\u00ebr biter t\u00eb ve\u00e7ant\u00eb, q\u00eb shfaqen gjat\u00eb p\u00ebrdorimit t\u00eb metodave t\u00eb analiz\u00ebs p\u00ebrmes kanaleve t\u00eb jashtme. Dob\u00ebsit\u00eb kan\u00eb kodin e em\u00ebrtimit Minerva. <\/p>\n

Projektet m\u00eb t\u00eb njohura q\u00eb preken nga metoda e propozuar t\u00eb sulmit jan\u00eb OpenJDK\/OracleJDK (CVE-2019-2894) dhe biblioteka Libgcrypt<\/a><\/noindex> (CVE-2019-13627), e p\u00ebrdorur n\u00eb GnuPG. Problemi \u00ebsht\u00eb gjithashtu i ekspozuar ndaj MatrixSSL<\/a><\/noindex>, Crypto++<\/a><\/noindex>, wolfCrypt<\/a><\/noindex>, elliptic<\/a><\/noindex>, jsrsasign<\/a><\/noindex>, python-ecdsa<\/a><\/noindex>, ruby_ecdsa<\/a><\/noindex>, fastecdsa<\/a><\/noindex>, easy-ecc<\/a><\/noindex> dhe kartat inteligjente Athena IDProtect. Kartat Valid S\/A IDflex V, SafeNet eToken 4300 dhe TecSec Armored Card gjithashtu jan\u00eb shpallur t\u00eb mundshme p\u00ebr t'u d\u00ebmtuar, edhe pse nuk jan\u00eb testuar, dhe ato p\u00ebrdorin modulin standard ECDSA. <\/p>\n

Problemi \u00ebsht\u00eb tashm\u00eb rregulluar n\u00eb versionet libgcrypt 1.8.5 dhe wolfCrypt 4.1.0, nd\u00ebrsa projektet e tjera ende nuk kan\u00eb hartuar p\u00ebrdit\u00ebsime. Ndjekja e rregullimit t\u00eb dob\u00ebsis\u00eb n\u00eb paket\u00ebn libgcrypt n\u00eb shp\u00ebrndarjet mund t\u00eb b\u00ebhet n\u00eb k\u00ebto faqe: Debian<\/a><\/noindex>, Ubuntu<\/a><\/noindex>, RHEL<\/a><\/noindex>, Fedora<\/a><\/noindex>, openSUSE\/SUSE<\/a><\/noindex>, FreeBSD<\/a><\/noindex>, Arch<\/a><\/noindex>.<\/p>\n

Dob\u00ebsit\u00eb nuk jan\u00eb t\u00eb ekspozuara<\/a><\/noindex> OpenSSL, Botan, mbedTLS dhe BoringSSL. Ende nuk jan\u00eb testuar Mozilla NSS, LibreSSL, Nettle, BearSSL, cryptlib, OpenSSL n\u00eb modalitetin FIPS, Microsoft .NET crypto,
\nlibkcapi nga b\u00ebrthama Linux, Sodium dhe GnuTLS.<\/p>\n

Problemi shkaktohet nga mund\u00ebsia e p\u00ebrcaktimit t\u00eb vlerave t\u00eb bit\u00ebve t\u00eb ve\u00e7ant\u00eb gjat\u00eb kryerjes s\u00eb nj\u00eb shum\u00ebzimi me skalar n\u00eb operacionet me kurba eliptike. P\u00ebr t\u00eb nxjerr\u00eb informacion rreth bit\u00ebve p\u00ebrdoren metoda indirekte, si\u00e7 \u00ebsht\u00eb vler\u00ebsimi i vones\u00ebs gjat\u00eb ekzekutimit t\u00eb llogaritjeve. P\u00ebr sulmin nevojitet akses i pa privilegjuar n\u00eb hostin ku realizohet gjenerimi i n\u00ebnshkrimit dixhital (jo p\u00ebrjashtohet<\/a><\/noindex> sulmi i larg\u00ebt, por ai \u00ebsht\u00eb shum\u00eb i komplikuar dhe k\u00ebrkon nj\u00eb volum t\u00eb madh t\u00eb dh\u00ebnash p\u00ebr analiza, prandaj mund t\u00eb konsiderohet si i pamundur). P\u00ebr t\u00eb ngarkuar disponibel<\/a><\/noindex> pajisjen e p\u00ebrdorur p\u00ebr sulmin.<\/p>\n

Pavar\u00ebsisht nga madh\u00ebsia e vog\u00ebl e rrjedhjes, p\u00ebr identifikimin ECDSA, mjaftojn\u00eb disa bita me informacion mbi vektorin e inicializimit (nonce) p\u00ebr t\u00eb realizuar nj\u00eb sulm p\u00ebr rikuperimin sekondar t\u00eb t\u00eb gjith\u00eb \u00e7el\u00ebsit privat. Sipas autor\u00ebve t\u00eb metod\u00ebs, p\u00ebr rikuperimin e suksessh\u00ebm t\u00eb \u00e7el\u00ebsit, mjafton analiza e disa qindra deri n\u00eb disa mij\u00ebra n\u00ebnshkrimeve digjitale t\u00eb gjeneruara p\u00ebr mesazhe t\u00eb njohura p\u00ebr sulmuesin. P\u00ebr shembull, p\u00ebr t\u00eb p\u00ebrcaktuar \u00e7el\u00ebsin privat t\u00eb p\u00ebrdorur n\u00eb kart\u00ebn e men\u00e7ur Athena IDProtect me baz\u00eb \u00e7ipi Inside Secure AT90SC, duke p\u00ebrdorur kthes\u00ebn elliptike secp256r1, u analizuan 11 mij\u00eb n\u00ebnshkrime digjitale. Koha totale e sulmit arriti n\u00eb 30 minuta.<\/p>\n

<\/a><\/noindex><\/p>\n

Burimi: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 \u0438\u043c. \u041c\u0430\u0441\u0430\u0440\u0438\u043a\u0430 \u0440\u0430\u0441\u043a\u0440\u044b\u043b\u0438 \u0441\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u043e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u0445 \u0432 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044f\u0445 \u0430\u043b\u0433\u043e\u0440\u0438\u0442\u043c\u0430 \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u044f \u0446\u0438\u0444\u0440\u043e\u0432\u043e\u0439 \u043f\u043e\u0434\u043f\u0438\u0441\u0438 ECDSA\/EdDSA, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0445 \u0432\u043e\u0441\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u044c \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u0435 \u043f\u0440\u0438\u0432\u0430\u0442\u043d\u043e\u0433\u043e \u043a\u043b\u044e\u0447\u0430 \u043d\u0430 \u043e\u0441\u043d\u043e\u0432\u0435 \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u0443\u0442\u0435\u0447\u0435\u043a \u0441\u0432\u0435\u0434\u0435\u043d\u0438\u0439 \u043e\u0431 \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u044b\u0445 \u0431\u0438\u0442\u0430\u0445, \u0432\u0441\u043f\u043b\u044b\u0432\u0430\u044e\u0449\u0438\u0445 \u043f\u0440\u0438 \u043f\u0440\u0438\u043c\u0435\u043d\u0435\u043d\u0438\u0438 \u043c\u0435\u0442\u043e\u0434\u043e\u0432 \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u043f\u043e \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0438\u043c \u043a\u0430\u043d\u0430\u043b\u0430\u043c. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0438 \u043a\u043e\u0434\u043e\u0432\u043e\u0435 \u0438\u043c\u044f Minerva. \u041d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u043c\u0438 \u043f\u0440\u043e\u0435\u043a\u0442\u0430\u043c\u0438, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u043f\u0440\u0435\u0434\u043b\u043e\u0436\u0435\u043d\u043d\u044b\u0439 \u043c\u0435\u0442\u043e\u0434 \u0430\u0442\u0430\u043a\u0438, \u044f\u0432\u043b\u044f\u044e\u0442\u0441\u044f OpenJDK\/OracleJDK (CVE-2019-2894) \u0438 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-38635","post","type-post","status-publish","format-standard","hentry","category-novosti-interneta"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Teknika e re e sulmit p\u00ebr kanale t\u00eb jashtme, q\u00eb lejon rikuperimin e \u00e7el\u00ebsave ECDSA | ProHoster","description":"K\u00ebrkuesit nga Universiteti Masariku zbuluan informacione mbi dob\u00ebsit\u00eb n\u00eb realizime t\u00eb ndryshme t\u00eb algoritmit t\u00eb krijimit t\u00eb n\u00ebnshkrimit digjital ECDSA\/EdDSA, q\u00eb lejojn\u00eb rikuperimin e vler\u00ebs s\u00eb \u00e7el\u00ebsit privat n\u00eb baz\u00eb t\u00eb analiz\u00ebs s\u00eb rrjedhjeve t\u00eb informacionit p\u00ebr bit\u00ebt e ve\u00e7ant\u00eb, q\u00eb shfaqen gjat\u00eb p\u00ebrdorimit t\u00eb metodave t\u00eb analiz\u00ebs p\u00ebr kanale t\u00eb jashtme. Dob\u00ebsit\u00eb mor\u00ebn emrin kodik Minerva. Projektet m\u00eb t\u00eb njohura q\u00eb preken nga metoda e propozuar t\u00eb sulmit jan\u00eb OpenJDK\/OracleJDK (CVE-2019-2894) dhe","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/novaya-tehnika-ataki-po-storonnim-kanalam-pozvolyayushhaya-vosstanovit-klyuchi-ecdsa","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041d\u043e\u0432\u0430\u044f \u0442\u0435\u0445\u043d\u0438\u043a\u0430 \u0430\u0442\u0430\u043a\u0438 \u043f\u043e \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0438\u043c \u043a\u0430\u043d\u0430\u043b\u0430\u043c, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u043e\u0441\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u044c \u043a\u043b\u044e\u0447\u0438 ECDSA | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 \u0438\u043c. \u041c\u0430\u0441\u0430\u0440\u0438\u043a\u0430 \u0440\u0430\u0441\u043a\u0440\u044b\u043b\u0438 \u0441\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u043e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u0445 \u0432 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044f\u0445 \u0430\u043b\u0433\u043e\u0440\u0438\u0442\u043c\u0430 \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u044f \u0446\u0438\u0444\u0440\u043e\u0432\u043e\u0439 \u043f\u043e\u0434\u043f\u0438\u0441\u0438 ECDSA\/EdDSA, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0445 \u0432\u043e\u0441\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u044c \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u0435 \u043f\u0440\u0438\u0432\u0430\u0442\u043d\u043e\u0433\u043e \u043a\u043b\u044e\u0447\u0430 \u043d\u0430 \u043e\u0441\u043d\u043e\u0432\u0435 \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u0443\u0442\u0435\u0447\u0435\u043a \u0441\u0432\u0435\u0434\u0435\u043d\u0438\u0439 \u043e\u0431 \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u044b\u0445 \u0431\u0438\u0442\u0430\u0445, \u0432\u0441\u043f\u043b\u044b\u0432\u0430\u044e\u0449\u0438\u0445 \u043f\u0440\u0438 \u043f\u0440\u0438\u043c\u0435\u043d\u0435\u043d\u0438\u0438 \u043c\u0435\u0442\u043e\u0434\u043e\u0432 \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u043f\u043e \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0438\u043c \u043a\u0430\u043d\u0430\u043b\u0430\u043c. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0438 \u043a\u043e\u0434\u043e\u0432\u043e\u0435 \u0438\u043c\u044f Minerva. \u041d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u043c\u0438 \u043f\u0440\u043e\u0435\u043a\u0442\u0430\u043c\u0438, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u043f\u0440\u0435\u0434\u043b\u043e\u0436\u0435\u043d\u043d\u044b\u0439 \u043c\u0435\u0442\u043e\u0434 \u0430\u0442\u0430\u043a\u0438, \u044f\u0432\u043b\u044f\u044e\u0442\u0441\u044f OpenJDK\/OracleJDK (CVE-2019-2894) \u0438","og:url":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/novaya-tehnika-ataki-po-storonnim-kanalam-pozvolyayushhaya-vosstanovit-klyuchi-ecdsa","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:24:58+00:00","article:modified_time":"2019-10-31T19:24:58+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"38635","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 22:51:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 01:06:23","updated":"2026-01-23 22:51:19"},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/38635","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=38635"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/38635\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=38635"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=38635"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=38635"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}