July 2022 - cypherpunks@lists.ogf.org

Sexstortion
by Gunnar Larson 04 Jul '22

04 Jul '22

FBI, is Dont Say Gay a form of Sexstortion? What about little girls? Seems like Florida should be held probably accountable to the FBI's new Sexstortion video here: https://fb.watch/e32i10cKJ1/

2 1

Cryptocurrency: Collapse of UK govt
by grarpamp 04 Jul '22

04 Jul '22

On 6/20/22, professor rat <pro2rat(a)yahoo.com.au> wrote: > Dying downward from the head [...] > the King is dead - long live the Queen [...] > https://cointelegraph.com/news/hm-treasury-changes-course-on-collecting-dat… Expect more chaos and bizarre in the world after the Queen dies. Best prepare not only your wallets, but your people and life.

1 0

Cryptocurrency: The Resurgence Of The Bearer Asset
by grarpamp 04 Jul '22

04 Jul '22

Bitcoin and the Resurgence of the Bearer Asset Scott Hill June 23, 2022 https://bombthrower.com/bitcoin-and-the-resurgence-of-the-bearer-asset/ If you’ve seen the film “Die Hard” you’ll notice the villain is trying to steal strange assets called Bearer Bonds. Why did this entire asset class disappear from the modern financial landscape? Which properties of these long forgotten assets are important for the future the Crypto industry is trying to build? Why did governments around the world outlaw the Bearer Asset in the first place? History of the Bearer Asset Until the 1980s, bearer assets were very common. Bonds would be issued on paper and bondholders would present the instruments physically to receive payment. In fact the paper certificates would often have small tear off sections that were redeemable for interest payments. This record keeping mechanism is why we still call the interest payments from Bonds, “coupons”. In the pre-digital era assets could be represented in two ways: Registered instruments, where every owner was recorded in a centralized registry. Transfers would be executed by a contract that was then “stamped” by the registrar. This would enable a verifiable list of owners to be kept and checked as necessary. Usually for taxation purposes or so that banks could be aware of who the true owners of a company seeking financial services were. Then there were bearer assets. Bearer assets were owned by whoever held them. They could be bought and sold by physically transferring the document. There was no registry of owners. This wasn’t some niche quirky asset class. Some of the most important companies in history issued bearer stock, like the Mississippi company, formed in 1717 and responsible for the infamous “Mississippi bubble”. Most governments issued bearer bonds to fund themselves. In the United States for example if you wanted to claim an interest payment on your government bonds you would need to physically present the certificates at your local Federal Reserve building. Bearer assets haven’t completely disappeared. Chances are if you open your wallet you still have some bearer assets in the form of your banknotes. They aren’t even from such a long time ago. The last US Government issued bearer bond only matured in 2016. The Problems with Bearer Assets Starting in the 1980s there was a concerted effort to eradicate bearer assets from the world. In a combined effort from FATF, the global anti-money laundering organization, and the US government, an agenda was pursued where all assets would become registered instruments. This would ensure that the owners of all assets could be known, taxed and tracked. The problems for governments are fairly obvious. Assets that you can hold privately and anonymously are difficult to tax. Transfers that can occur between two people without any authority being notified can be used to launder money or evade capital controls. There’s also the issue of counterfeiting. In 2009, over $130 billion in US government bearer bonds were uncovered by Italian customs officials. Without a central register modern printing techniques had made bearer instruments far too easy to counterfeit. The practical issues are possibly more important for this analysis. Without a centralized authority to record ownership it’s difficult to develop the trust required to exchange assets between entities who don’t already have a business relationship. Transfers are also slow compared with changing an entry in a computer database if you’re not in the same place as your counter-party. This problem is particularly noticeable if there isn’t a ready market for assets nearby. For example, in the 1900s it would be difficult to exchange bearer assets in Nebraska where there was no market, but relatively easy to do so in New York. The Benefits of Bearer Assets The need for a physical marketplace for bearer assets is a large part of the reason why financial hubs like New York, London and Amsterdam arose. Bearer assets could simply be handed over in exchange for cash so traders would congregate around the largest markets. Traders could exchange bearer assets as quickly as necessary without needing to stop and register each transaction. This ease of transfer was a significant financial innovation in earlier eras and could be credited for pushing forward capitalism itself by making corporate shares and bonds easily tradable assets. Portability and usability were also significant features. In this previous era you might take a loan on your stock or bonds by physically depositing the certificates as collateral with a bank. If you needed to relocate countries your assets could easily move with you and be used in your new country without requiring any verification from the institutions in your previous homeland. Bearer assets opened up the ability to perform global capitalism in a way that simply wasn’t possible before their invention. A stock certificate could be issued in Paris then transported to Amsterdam and traded at their stock exchange with ease. This did open up some strange issues with corporate governance however. Shareholders scattered throughout the globe are not easy to contact and gather for a shareholders meeting. The Modern System Now that bearer assets are all but wiped out, the modern asset system functions using a string of registries and a plethora of intermediaries. A modern stock certificate might be held digitally with the DTCC in New York, on trust for a German Holding company who then fractionalizes the share and sells those fractions to Robinhood who then sells those fractions to an investor. Complicated, huh? But it all works seamlessly thanks to digital communications systems and trust. The trust part is important. This entire system is held up by trust in other countries’ regulatory authorities. In the solvency of their financial institutions. In their systems. It could all go away very quickly if that were no longer the case. We already see what this world would look like by examining how emerging markets operate. Would you trust an Argentine stock registry to record your assets? How about an Iranian one? Bitcoin Fixes This If we are heading into a fractured world as many analysts are predicting, we’ll need the return of bearer assets to keep capital markets functioning. Cryptocurrencies like Bitcoin represent the return of the bearer asset in the form of digital shared ledgers. Just like old paper bearer assets, an individual can prove they own their digital assets directly, without the assistance and trust of intermediaries. They can simply sign using their wallet to confirm ownership of the assets held within. People can transfer digital assets directly, globally, at near instant speeds. This financial innovation is both extremely powerful but also extremely risky for the current institutions that exist primarily to provide trust and custody to assets. Most people who haven’t gone down the Bitcoin rabbithole yet don’t really understand the paradigm shift that has happened with the invention of digital bearer assets. They can type an order into their stock trading app and to them that’s as good as Bitcoin’s near instant global settlement. They fail to see the fundamental difference. Trading a stock on an online exchange relies on a huge number of intermediaries to execute the trade, to store the assets and to verify the existence of assets. If you hold a share of a company in the modern system it’s impossible to prove this fact directly. The best you can do is present a brokerage account statement and ask that your brokerage is trusted. This system of trust works fine in the functional modern world we have lived in for decades, but in a world where trust is fragmented and scarce, the ability to secure and prove your ownership of assets without asking permission may become invaluable. Benefits of Digital Bearer Assets Digital assets don’t have to only be useful assets for the end of the world. The ability to trade assets globally without the involvement of authorities and institutions means that unlike stocks, digital assets can tap global liquidity and allow capital formation to know no borders or class divides. It’s relatively easy for a rural Kenyan farmer to purchase a dollar worth of Bitcoin. It’s nearly impossible for the same person to acquire a dollar worth of Amazon stock. There’s also the nature of blockchain infrastructure to consider. The entire premise of token based blockchains is that they are financial ecosystems that utilize tokens to represent ownership. This allows blockchain systems to achieve near instant financial functions with final settlement. A fundamentally different experience to using something like the Visa network which can take days to settle. A merchant would then need to ask permission from their bank to utilize those funds again after that long lag time. Ensuring that ownership of tokens is directly verifiable and transferable by users is fundamental to using blockchains to power finance. Blockchains would not be a useful innovation with bloated middlemen getting in between transactions and adding the same delays that we currently experience. The design of cryptocurrencies with open ledgers that are verifiable by anyone also removes some of the issues with old paper bearer assets. Tokenholders can be identified and contacted significantly more easily than the holders of paper assets. It would even be easier than the methods used under the current system of share registries and chains of intermediaries holding assets on behalf of others. This tangled web of ownership often leads to shareholder voting being an impossible to coordinate task. Instead asset holding mega-firms like Blackrock vote on behalf of all of their clients. Digital bearer assets could be a path back to functional shareholder coordination and governance. Return to Capitalism Digital assets fundamentally change the nature of assets back to something that looks more like traditional capitalism, where individual asset owners can pool capital directly and efficiently. Where people can truly own assets, not just be granted access to asset markets by intermediaries. The ramifications of this increase of speed and global access to finance are staggering. We’ve really only seen the first stages of what this technology can enable. There will be growing pains along the way. Governments and institutions will need to adapt to this paradigm shift. Just like bearer instruments unlocked the power of capitalism in the 18th century, digital bearer instruments could do the same for the 21st century. Scott Hill Scott Hill Scott Hill is a lawyer turned macroeconomics researcher in the cryptocurrency media space. He holds a BSc in mathematics with minors in cryptography and physics. He currently advises Coindesk and is a contributing analyst to Bombthrower Media 4 Responses Avatar Bill says: June 23, 2022 at 4:56 pm Great analogy to showcase use of bearer assets. I Home school my grand kids and will use this to help them learn the power of capitalism in modern day terms. They will be fascinated by the comparison to bitcoin. Every Kid that plays video games, has a distinct understanding of cryptocurrency. This should be interesting to begin the discussion. The grand kids will be 13 in august and they will get it! Then, after test drive on the Kids who will pick it up quickly, I will try it on all my friends over 60. Wish me luck! Thanks B Reply Avatar Ken says: June 26, 2022 at 3:09 pm Much luck regarding your aged 60+ friends. Their world views are hard wired and neural pathways of their physical brains generally are too ossified to allow the perspectival flexibility to explore beyond the boundaries of their security. The West’s debt-based Fiat system is their hard wired God and that won’t change. As an aged 60+ member myself with 35 years of banking/finance experience and as an early adapter to crypto, I recommend you restrain your enthusiasm and energy with them, if for no better reason than the continuance of your friendships. They may have the great bulk of the world’s assets, but time is not on their side and their assets that survive the many changes ahead will all be absorbed into the emergent new ecosystems in due course anyway, so there’s no reason to push them beyond the limits of their personal security, especially with crypto’s volatility in its present stage of development. Especially with its challenges ahead, and particularly from the emergence quantum computing and its greatly elevated cybersecurity risks and safety requirements. Reply Avatar S Stackmore says: June 23, 2022 at 7:29 pm We talked about and imagined Digital Bearer Assets/Instruments back in the late 90’s. Now we have them. While I am not an “everything on the blockchain” kind of guy–more of a maxi– in principle messaging via public/private keys tied to UTXOs should allow for some kind of voting structure. Maybe that is what the proof of stake guys are working on? I haven’t really paid attention to them. I mean if you wanted replicate some form of the capital structure with rights attached digitally to facilitate pooling of capital for actual enterprises, ownership of which could be traded on unregulated markets…. Reply Avatar David Tea says: June 23, 2022 at 10:26 pm Great article. One could even issue promissory notes against the value of the digital bearer bonds…to help discharge the current debt created by those fools/tools purportedly actiing as public servants…in name only

1 0

[ot][random][spam] Beyond HertzBleed: Reverse Engineering the Butterfly Effect
by Undiscussed Horrific Abuse, One Victim of Many 04 Jul '22

04 Jul '22

just making a topic for this for completeness, not seeing much the value of exploring it in depth atm basically hertzbleed shows how a subtle influence from code details can be used, with accumulated and chosen data, to reconstruct information at a distance. there's a lot more influence from things than a cpu's frequency scaling. a _lot_ . and this stuff is happening now with transformer models: picking up what things are based on complex data with degrees of removal from the information in question. could clearly be used to crack cryptography, but it seems other things are building.

1 0

Hertzbleed explained
by zeynep＠keemail.me 04 Jul '22

04 Jul '22

Hertzbleed explained https://blog.cloudflare.com/hertzbleed-explained/ You may have heard a bit about the Hertzbleed attack that was recently disclosed. Fortunately, one of the student researchers who was part of the team that discovered this vulnerability and developed the attack is spending this summer with Cloudflare Research and can help us understand it better. The first thing to note is that Hertzbleed is a new type of side-channel attack that relies on changes in CPU frequency. Hertzbleed is a real, and practical, threat to the security of cryptographic software. Should I be worried? >From the Hertzbleed website, “If you are an ordinary user and not a cryptography engineer, probably not: you don’t need to apply a patch or change any configurations right now. If you are a cryptography engineer, read on. Also, if you are running a SIKE decapsulation server, make sure to deploy the mitigation described below.”Notice: As of today, there is no known attack that uses Hertzbleed to target conventional and standardized cryptography, such as the encryption used in Cloudflare products and services. Having said that, let’s get into the details of processor frequency scaling to understand the core of this vulnerability. In short, the Hertzbleed attack shows that, under certain circumstances, dynamic voltage and frequency scaling (DVFS), a power management scheme of modern x86 processors, depends on the data being processed. This means that on modern processors, the same program can run at different CPU frequencies (and therefore take different wall-clock times). For example, we expect that a CPU takes the same amount of time to perform the following two operations because it uses the same algorithm for both. However, there is an observable time difference between them: Before giving the answer we will explain some details about how Hertzbleed works and its impact on SIKE, a new cryptographic algorithm designed to be computationally infeasible for an adversary to break, even for an attacker with a quantum computer. Frequency ScalingSuppose a runner is in a long distance race. To optimize the performance, the heart monitors the body all the time. Depending on the input (such as distance or oxygen absorption), it releases the appropriate hormones that will accelerate or slow down the heart rate, and as a result tells the runner to speed up or slow down a little. Just like the heart of a runner, DVFS (dynamic voltage and frequency scaling) is a monitor system for the CPU. It helps the CPU to run at its best under present conditions without being overloaded. Just as a runner’s heart causes a runner’s pace to fluctuate throughout a race depending on the level of exertion, when a CPU is running a sustained workload, DVFS modifies the CPU’s frequency from the so-called steady-state frequency. DVFS causes it to switch among multiple performance levels (called P-states) and oscillate among them. Modern DVFS gives the hardware almost full control to adjust the P-states it wants to execute in and the duration it stays at any P-state. These modifications are totally opaque to the user, since they are controlled by hardware and the operating system provides limited visibility and control to the end-user. The ACPI specification defines P0 state as the state the CPU runs at its maximum performance capability. Moving to higher P-states makes the CPU less performant in favor of consuming less energy and power. How long does the CPU stay at each P-state? Most importantly, how can this even lead to a vulnerability? Excellent questions! Modern DVFS is designed this way because CPUs have a Thermal Design Point (TDP), indicating the expected power consumption at steady state under a sustained workload. For a typical computer desktop processor, such as a Core i7-8700, the TDP is 65 W. To continue our human running analogy: a typical person can sprint only short distances, and must run longer distances at a slower pace. When the workload is of short duration, DVFS allows the CPU to enter a high-performance state, called Turbo Boost on Intel processors. In this mode, the CPU can temporarily execute very quickly while consuming much more power than TDP allows. But when running a sustained workload, the CPU average power consumption should stay below TDP to prevent overheating. For example, as illustrated below, suppose the CPU has been free of any task for a while, the CPU runs extra hard (Turbo Boost on) when it just starts running the workload. After a while, it realizes that this workload is not a short one, so it slows down and enters steady-state. How much does it slow down? That depends on the TDP. When entering steady-state, the CPU runs at a certain speed such that its current power consumption is not above TDP. CPU entering steady state after running at a higher frequencyBeyond protecting CPUs from overheating, DVFS also wants to maximize the performance. When a runner is in a marathon, she doesn't run at a fixed pace but rather her pace floats up and down a little. Remember the P-state we mentioned above? CPUs oscillate between P-states just like runners adjust their pace slightly over time. P-states are CPU frequency levels with discrete increments of 100 MHz. CPU frequency changes at discrete increments.CPU frequency levels with discrete incrementsThe CPU can safely run at a high P-state (low frequency) all the time to stay below TDP, but there might be room between its power consumption and the TDP. To maximize CPU performance, DVFS utilizes this gap by allowing the CPU to oscillate between multiple P-states. The CPU stays at each P-state for only dozens of milliseconds, so that its temporary power consumption might exceed or fall below TDP a little, but its average power consumption is equal to TDP. To understand this, check out this figure again. If the CPU only wants to protect itself from overheating, it can run at P-state 3.9 GHz safely. However, DVFS wants to maximize the CPU performance by utilizing all available power allowed by TDP. As a result, the CPU oscillates around the P-state 4.0 GHz. It is never far above or below. When at 4.1 GHz, it overloads itself a little, it then drops to a higher P-state. When at 3.9 GHz, it recovers itself, it quickly climbs to a lower P-state. It may not stay long in any P-state, which avoids overheating when at 4.1 GHz and keeps the average power consumption near the TDP. This is exactly how modern DVFS monitors your CPU to help it optimize power consumption while working hard. Again, how can DVFS and TDP lead to a vulnerability? We are almost there! Frequency Scaling vulnerabilityThe design of DVFS and TDP can be problematic because CPU power consumption is data-dependent! The Hertzbleed paper gives an explicit leakage model of certain operations identifying two cases. First, the larger the number of bits set (also known as the Hamming weight) in the operands, the more power an operation takes. The Hamming weight effect is widely observed with no known explanation of its root cause. For example, hamming weightThe addition on the left will consume more power compared to the one on the right. Similarly, when registers change their value there are power variations due to transistor switching. For example, a register switching its value from A to B (as shown in the left) requires flipping only one bit because the Hamming distance of A and B is 1. Meanwhile, switching from C to D will consume more energy to perform six bit transitions since the Hamming distance between C and D is 6. Hamming distanceHamming distanceNow we see where the vulnerability is! When running sustained workloads, CPU overall performance is capped by TDP. Under modern DVFS, it maximizes its performance by oscillating between multiple P-states. At the same time, the CPU power consumption is data-dependent. Inevitably, workloads with different power consumption will lead to different CPU P-state distribution. For example, if workload w1 consumes less power than workload w2, the CPU will stay longer in lower P-state (higher frequency) when running w1. As a result, since the power consumption is data-dependent, it follows that CPU frequency adjustments (the distribution of P-states) and execution time (as 1 Hertz = 1 cycle per second) are data-dependent too. Consider a program that takes five cycles to finish as depicted in the following figure. Different frequency resulting in different running time with constant-cycle programCPU frequency directly translate to running timeAs illustrated in the table below, f the program with input 1 runs at 4.0 GHz (red) then it takes 1.25 nanoseconds to finish. If the program consumes more power with input 2, under DVFS, it will run at a lower frequency, 3.5 GHz (blue). It takes more time, 1.43 nanoseconds, to finish. If the program consumes even more power with input 3, under DVFS, it will run at an even lower frequency of 3.0 GHz (purple). Now it takes 1.67 nanoseconds to finish. This program always takes five cycles to finish, but the amount of power it consumes depends on the input. The power influences the CPU frequency, and CPU frequency directly translates to execution time. In the end, the program's execution time becomes data-dependent. Execution time of a five cycles programFrequency 4.0 GHz 3.5 GHz 3.0 GHzExecution Time 1.25 ns 1.43 ns 1.67 nsTo give you another concrete example: Suppose we have a sustained workload Foo. We know that Foo consumes more power with input data 1, and less power with input data 2. As shown on the left in the figure below, if the power consumption of Foo is below the TDP, CPU frequency as well as running time stays the same regardless of the choice of input data. However, as shown in the middle, if we add a background stressor to the CPU, the combined power consumption will exceed TDP. Now we are in trouble. CPU overall performance is monitored by DVFS and capped by TDP. To prevent itself from overheating, it dynamically adjusts its P-state distribution when running workload with various power consumption. P-state distribution of Foo(data 1) will have a slight right shift compared to that of Foo(data 2). As shown on the right, CPU running Foo(data 1) results in a lower overall frequency and longer running time. The observation here is that, if data is a binary secret, an attacker can infer data by simply measuring the running time of Foo! Detailed explanation of HertzbleedComplete recap of Hertzbleed. Figure taken from Intel’s documentation. This observation is astonishing because it conflicts with our expectation of a CPU. We expect a CPU to take the same amount of time computing these two additions. However, Hertzbleed tells us that just like a person doing math on paper, a CPU not only takes more power to compute more complicated numbers but also spends more time as well! This is not what a CPU should do while performing a secure computation! Because anyone that measures the CPU execution time should not be able to infer the data being computed on. This takeaway of Hertzbleed creates a significant problem for cryptography implementations because an attacker shouldn’t be able to infer a secret from program’s running time. When developers implement a cryptographic protocol out of mathematical construction, a goal in common is to ensure constant-time execution. That is, code execution does not leak secret information via a timing channel. We have witnessed that timing attacks are practical: notable examples are those shown by Kocher, Brumley-Boneh, Lucky13, and many others. How to properly implement constant-time code is subject of extensive study. Historically, our understanding of which operations contribute to time variation did not take DVFS into account. The Hertzbleed vulnerability derives from this oversight: any workload which differs by significant power consumption will also differ in timing. Hertzbleed proposes a new perspective on the development of secure programs: any program vulnerable to power analysis becomes potentially vulnerable to timing analysis! Which cryptographic algorithms are vulnerable to Hertzbleed is unclear. According to the authors, a systematic study of Hertzbleed is left as future work. However, Hertzbleed was exemplified as a vector for attacking SIKE. Brief description of SIKEThe Supersingular Isogeny Key Encapsulation (SIKE) protocol is a Key Encapsulation Mechanism (KEM) finalist of the NIST Post-Quantum Cryptography competition (currently at Round 3). The building block operation of SIKE is the calculation of isogenies (transformations) between elliptic curves. You can find helpful information about the calculation of isogenies in our previous blog post. In essence, calculating isogenies amounts to evaluating mathematical formulas that take as inputs points on an elliptic curve and produce other different points lying on a different elliptic curve. Isogeny between elliptic curves.SIKE bases its security on the difficulty of computing a relationship between two elliptic curves. On the one hand, it’s easy computing this relation (called an isogeny) if the points that generate such isogeny (called the kernel of the isogeny) are known in advance. On the other hand, it’s difficult to know the isogeny given only two elliptic curves, but without knowledge of the kernel points. An attacker has no advantage if the number of possible kernel points to try is large enough to make the search infeasible (computationally intractable) even with the help of a quantum computer. Similarly to other algorithms based on elliptic curves, such as ECDSA or ECDH, the core of SIKE is calculating operations over points on elliptic curves. As usual, points are represented by a pair of coordinates (x,y) which fulfill the elliptic curve equation where A is a parameter identifying different elliptic curves. For performance reasons, SIKE uses one of the fastest elliptic curve models: the Montgomery curves. The special property that makes these curves fast is that it allows working only with the x-coordinate of points. Hence, one can express the x-coordinate as a fraction x = X / Z, without using the y-coordinate at all. This representation simplifies the calculation of point additions, scalar multiplications, and isogenies between curves. Nonetheless, such simplicity does not come for free, and there is a price to be paid. The formulas for point operations using Montgomery curves have some edge cases. More technically, a formula is said to be complete if for any valid input a valid output point is produced. Otherwise, a formula is not complete, meaning that there are some exceptional inputs for which it cannot produce a valid output point. Elliptic curve formulas have some exceptional points.In practice, algorithms working with incomplete formulas must be designed in such a way that edge cases never occur. Otherwise, algorithms could trigger some undesired effects. Let’s take a closer look at what happens in this situation. A subtle yet relevant property of some incomplete formulas is the nature of the output they produce when operating on points in the exceptional set. Operating with anomalous inputs, the output has both coordinates equal to zero, so X=0 and Z=0. If we recall our basics on fractions, we can figure out that there is something odd in a fraction X/Z = 0/0; furthermore it was always regarded as something not well-defined. This intuition is not wrong, something bad just happened. This fraction does not represent a valid point on the curve. In fact, it is not even a (projective) pointThe domino effectDomino-effect, domino pieces falling down.Exploiting this subtlety of mathematical formulas makes a case for the Hertzbleed side-channel attack. In SIKE, whenever an edge case occurs at some point in the middle of its execution, it produces a domino effect that propagates the zero coordinates to subsequent computations, which means the whole algorithm is stuck on 0. As a result, the computation gets corrupted obtaining a zero at the end, but what is worse is that an attacker can use this domino effect to make guesses on the bits of secret keys. Trying to guess one bit of the key requires the attacker to be able to trigger an exceptional case exactly at the point in which the bit is used. It looks like the attacker needs to be super lucky to trigger edge cases when it only has control of the input points. Fortunately for the attacker, the internal algorithm used in SIKE has some invariants that can help to hand-craft points in such a way that triggers an exceptional case exactly at the right point. A systematic study of all exceptional points and edge cases was, independently, shown by De Feo et al. as well as in the Hertzbleed article. With these tools at hand, and using the DVFS side channel, the attacker can now guess bit-by-bit the secret key by passing hand-crafted invalid input points. There are two cases an attacker can observe when the SIKE algorithm uses the secret key: If the bit of interest is equal to the one before it, no edge cases are present and computation proceeds normally, and the program will take the expected amount of wall-time since all the calculations are performed over random-looking data.On the other hand, if the bit of interest is different from the one before it, the algorithm will enter the exceptional case, triggering the domino effect for the rest of the computation, and the DVFS will make the program run faster as it automatically changes the CPU’s frequency.Using this oracle, the attacker can query it, learning bit by bit the secret key used in SIKE. Ok, let’s recap. SIKE uses special formulas to speed up operations, but if these formulas are forced to hit certain edge cases then they will fail. Failing due to these edge cases not only corrupts the computation, but also makes the formulas output coordinates with zeros, which in machine representation amount to several registers all loaded with zeros. If the computation continues without noticing the presence of these edge cases, then the processor registers will be stuck on 0 for the rest of the computation. Finally, at the hardware level, some instructions can consume fewer resources if operands are zeroed. Because of that, the DVFS behind CPU power consumption can modify the CPU frequency, which alters the steady-state frequency. The ultimate result is a program that runs faster or slower depending on whether it operates with all zeros versus with random-looking data. Hertzbleed logo, a clock with a frequency signal.Hertzbleed’s authors contacted Cloudflare Research because they showed a successful attack on CIRCL, our optimized Go cryptographic library that includes SIKE. We worked closely with the authors to find potential mitigations in the early stages of their research. While the embargo of the disclosure was in effect, another research group including De Feo et al. independently described a systematic study of the possible failures of SIKE formulas, including the same attack found by the Hertzbleed team, and pointed to a proper countermeasure. Hertzbleed borrows such a countermeasure. What countermeasures are available for SIKE?Stopping the domino effect.The immediate action specific for SIKE is to prevent edge cases from occurring in the first place. Most SIKE implementations provide a certain amount of leeway, assuming that inputs will not trigger exceptional cases. This is not a safe assumption. Instead, implementations should be hardened and should validate that inputs and keys are well-formed. Enforcing a strict validation of untrusted inputs is always the recommended action. For example, a common check on elliptic curve-based algorithms is to validate that inputs correspond to points on the curve and that their coordinates are in the proper range from 0 to p-1 (as described in Section 3.2.2.1 of SEC 1). These checks also apply to SIKE, but they are not sufficient. What malformed inputs have in common in the case of SIKE is that input points could have arbitrary order—that is, in addition to checking that points must lie on the curve, they must also have a prescribed order, so they are valid. This is akin to small subgroup attacks for the Diffie-Hellman case using finite fields. In SIKE, there are several overlapping groups in the same curve, and input points having incorrect order should be detected. The countermeasure, originally proposed by Costello, et al., consists of verifying whether the input points are of the right full-order. To do so, we check whether an input point vanishes only when multiplied by its expected order, and not before when multiplied by smaller scalars. By doing so, the hand-crafted invalid points will not pass this validation routine, which prevents edge cases from appearing during the algorithm execution. In practice, we observed around a 5-10% performance overhead on SIKE decapsulation. The ciphertext validation is already available in CIRCL as of version v1.2.0. We strongly recommend updating your projects that depend on CIRCL to this version, so you can make sure that strict validation on SIKE is in place. Closing commentsHertzbleed shows that certain workloads can induce changes on the frequency scaling of the processor, making programs run faster or slower. In this setting, small differences on the bit pattern of data result in observable differences on execution time. This puts a spotlight on the state-of-the-art techniques we know so far used to protect against timing attacks, and makes us rethink the measures needed to produce constant-time code and secure implementations. Defending against features like DVFS seems to be something that programmers should start to consider too. Although SIKE was the victim this time, it is possible that other cryptographic algorithms may expose similar symptoms that can be leveraged by Hertzbleed. An investigation of other targets with this brand-new tool in the attacker’s portfolio remains an open problem. Hertzbleed allowed us to learn more about how the machines we have in front of us work and how the processor constantly monitors itself, optimizing the performance of the system. Hardware manufacturers have focused on performance of processors by providing many optimizations, however, further study of the security of computations is also needed. If you are excited about this project, at Cloudflare we are working on raising the bar on the production of code for cryptography. Reach out to us if you are interested in high-assurance tools for developers, and don’t forget our outreach programs whether you are a student, a faculty member, or an independent researcher.

1 0

[ot] Messaging grarpamp
by Karl Semich 04 Jul '22

04 Jul '22

Hi grarpamp, I don't often receive replies from you, but I wanted to check in cause I've gotten a couple negative emails from your email address about my ongoing spam threads. I consider you a helpful friend in technical domains, and I tend to stay away from your threads that I see as more heavily politically biased. I suspect that either our communications are filtered to prevent us communicating, that you mostly don't consider me reasonable to communicate with, or that you are working for something focused on specific expression. Thanks for your contributing technical posts. Curious to know how things stand. k

1 0

The Who sell out
by professor rat 04 Jul '22

04 Jul '22

Shitcoin to shitcoin - dust to dust " . . . Investment Firm Cypherpunk Holdings Sells All of Its Bitcoin and Ether - CoinDesk CoinDesk Investment Firm Cypherpunk Holdings Sells All of Its Bitcoin and Ether · The publicly listed firm has transitioned its treasury to cash . . . " They tried to steal our good name - they tried and died.

1 0

In our region, the main enemy here and now is Russian imperialism.
by professor rat 04 Jul '22

04 Jul '22

THE POSITION OF THE GROUP OF BELARUSIAN ANARCHISTS IN WARSAW ON THE WAR IN UKRAINE https://anarchistnews.org/content/position-group-belarusian-anarchists-wars… Solidarity and support for Belarus-based anarchs - Death to Israel Shamir and Pooter

1 0

Overtly KGB fascist and antisemitic types GO FUCK YOURSELF
by professor rat 03 Jul '22

03 Jul '22

Russia Insider founder Charles Bausman traveled from his home in Lancaster, Pennsylvania, to Washington, D.C., on Jan. 6, and video appears to show him among the insurrectionists that breached the building's walls. Soon after, he left the country for Moscow. Bausman, 57, is an American man known for producing the pro-Kremlin website Russia Insider, which he has in recent years infused with overtly fascist and antisemitic content. https://www.splcenter.org/hatewatch/2021/09/01/far-right-propagandist-turns… Reposts are not fully endorsed necessarily so STFU pedants

1 0

Directorates Who Discredit Truthful Witnesses (W/80 Highlights)
by Gunnar Larson 03 Jul '22

03 Jul '22

https://thecapital.io/article/directorates-who-discredit-truthful-witnesses… “And the persons who ultimately are harmed by all of this, of course, is the average consumer, the average citizen, who has no knowledge, unless it paid attention to this hearing, of the extent of the manipulations that have been carried out by the largest financial institutions in America and, indeed, probably the world.” - Senator John McCain

1 0