Abstract
Side channels have long been recognised as a threat to the security of cryptographic applications. Implementations can unintentionally leak secret information through many channels, such as microarchitectural state changes in processors, changes in power consumption, or electromagnetic radiation. As a result of these threats, many implementations have been hardened to defend against these attacks. Despite these mitigations, this work presents a novel side-channel attack against ECDSA and DSA. The attack targets a common implementation pattern that is found in many cryptographic libraries. In fact, about half of the libraries that were tested exhibited the vulnerable
pattern. We implement a full proof of concept against OpenSSL and demonstrate that it is possible to extract a 256-bit ECDSA private key using a simple cache attack after observing only a few thousand signatures. As far as we are aware, the target of this attack is a previously unexplored part of (EC)DSA signature generation, which explains why mitigations are lacking and the issue is so widespread. Finally, we give estimates for the minimum number of signatures needed to perform the attack and suggest countermeasures to protect against this attack.
