"Three University of Michigan computer scientists say they have found a way to exploit a weakness in RSA security technology used to protect everything from media players to smartphones and e-commerce servers.
RSA authentication is susceptible, they say, to changes in the voltage supplied to a private key holder.
'The RSA algorithm gives security under the assumption that as long as the private key is private, you can't break in unless you guess it. We've shown that that's not true', said Valeria Bertacco, an associate professor in the Department of Electrical Engineering and Computer Science, in a statement.
[...] While guessing the 1,000-plus digits of binary code in a private key would take unfathomable hours, the researchers say that by varying electric current to a secured computer using an inexpensive purpose-built device they were able to stress out the computer and figure out the 1,024-bit private key in about 100 hours – all without leaving a trace. [...] They also say they have come up with a solution, which involves a cryptographic technique called salting that involves randomly juggling a private key's digits."
Read the full article: networkworld.com >> Researchers find way to zap RSA security scheme
The paper outlining the findings (pdf): Fault-based attack of RSA authentication
Comments [0]