The sophistication of these attacks always blows my mind.
"By using an oscilloscope to measure the electromagnetic radiation while the token is authenticating itself, the researchers can detect tiny execution time differences that reveal a token’s ephemeral ECDSA key, also known as a nonce. Further analysis allows the researchers to extract the secret ECDSA key that underpins the entire security of the token."
https://arstechnica.com/security/2024/09/yubikeys-are-vulnerable-to-cloning-attacks-thanks-to-newly-discovered-side-channel/
MossyCode
npub1zd…fhzsm
2024-09-03 20:33:19
Author Public Key
npub1zddnu66dg05c6m97mzdpe3da7qu0ngjnvuzaetwkwu8w9h5lhx4s4fhzsmPublished at
2024-09-03 20:33:19Event JSON
{
"id": "29f95dc25d80e004c6678cf10143993ccad1b379ac7f6e4b3ce7ba62eb0e21cb",
"pubkey": "135b3e6b4d43e98d6cbed89a1cc5bdf038f9a2536705dcadd6770ee2de9fb9ab",
"created_at": 1725395599,
"kind": 1,
"tags": [],
"content": "The sophistication of these attacks always blows my mind.\n\n\"By using an oscilloscope to measure the electromagnetic radiation while the token is authenticating itself, the researchers can detect tiny execution time differences that reveal a token’s ephemeral ECDSA key, also known as a nonce. Further analysis allows the researchers to extract the secret ECDSA key that underpins the entire security of the token.\"\n\nhttps://arstechnica.com/security/2024/09/yubikeys-are-vulnerable-to-cloning-attacks-thanks-to-newly-discovered-side-channel/",
"sig": "a032ca85622ea95238d98da9ee5cd80471ee934388b9659f24a57748b19fd80722c35dedea2e6d88e1b85b165e7c1d34485a8bde5be4aa46af979e51ff1c8f6a"
}