Resources

People often ask me "How did you learn how to hack?" The answer: by reading. This page is a collection of the blog posts and other articles that I have accumulated over the years of my journey. Enjoy!

This paper discusses the ability to decrypt plaintext or sign values after temporary access to a signing/decryption oracle for a given key, allowing the attacker to craft arbitrary signatures from the key. It requires substantial precomputation and a ridiculous number of collected values. Regardless, it's possible, and pretty neat. The attack uses an underappreciated paper from 2007 about the Number Field Sieve (NFS) extension called the eth root of NFS.

The attack has two stages. The first is a precomputation stage that only relies on the public modulus and exponent. This uses a large-number sieve to generate a large set of algebraic relations. Next, specific values are asked to be encrypted that are chosen from the precomputation table above. At this point, the target device is no longer there but we want to make a signature for it.

The goal is to create a table of relations that, when you want to do some other action, you know enough about it to encrypt the data. The information from the previous steps allows for this.

Using the information from before, use an NFS descent on the target. Use the generated relations to construct the value you want without ever knowing any of the secret values. They did this on a real HSM 1024-bit RSA, and got it work!

This required 2^32 queries to the HSM, and 1200 core years of precomputation to setup. After that, the attack took 180 core-years to perform. On the HSM, it took about five months of running to get the required values.

This is vastly cheaper than the expected bit-level security guarantees of the key! They claim that given an oracle described like this, it reduces the key by about 15-30 bits. They claim these scenarios may exist for HSMs and some other locations.

I don't understand the math at all. But, the security of RSA is crumbling and it's interesting to see it happen before my eyes. Great job resurecting old research into a reduction of the security of RSA!