Fergie's Tech Blog

New Attack Can Recover Complete AES Keys

Dennis Fisher writes in eWeek:

A new timing attack against the AES algorithm can be used to extract entire Advanced Encryption Standard keys from remote servers.

Daniel Bernstein, an associate professor at the University of Illinois at Chicago, recently released a paper showing how an attack against a server running the OpenSSL AES implementation could recover the entire encryption key.

The attack is based on an attacker watching the victim machine and observing how long it takes to perform various cryptographic functions in AES. Through that observation, the attacker can glean certain data about the secret key and use statistical analysis to recover the key. "This attack should be blamed on the AES design, not on the particular AES library used by the [target] server," Bernstein wrote in his paper.

posted by Fergie @ 5/23/2005 03:40:00 PM