#Ninjalab also has their own site about their #EUCLEAK research: https://ninjalab.io/eucleak/

Side-channel #EUCLEAK attack discovered on devices using the Infineon cryptographic library, like the YubiKey 5 series (firmware <5.7) and Feitian A22 JavaCard.

But it does require a fair amount of factors to succeed: username, password, physical access, additional equipment, and for the cryptographic operations to involve modular inversions, like ECDSA.

There are two phases to the attack:

(1) The online phase requires opening the device to access the microcontroller, then using an electromagnetic probe, an oscilloscope, and a computer to capture the electromagnetic side-channel signals during operation.

(2) The offline phase (physical access no longer necessary) supposedly takes time varying from one hour to one day for each secret to uncover.

https://ninjalab.io/wp-content/uploads/2024/09/20240903_eucleak.pdf

#ninjalab #eucleak #sidechannel #attack #infineon #yubikey #feitian

Des clés de sécurité #Yubico peuvent être clonées par canal auxiliaire - https://next.ink/148837/des-cles-de-securite-yubico-peuvent-etre-clonees-par-canal-auxiliaire/

> Les chercheurs français de #NinjaLab (Montpellier) ont découvert qu’il était possible de cloner des clés de sécurité #YubiKey 5 en utilisant un canal auxiliaire. La probabilité d’une attaque de grande ampleur est très faible, notamment car il faut posséder de nombreux éléments, du matériel spécifique et un accès à la machine visée.

Y'a des alternatives à ça ? J'en cherche.

#sécurité

YubiKeys are vulnerable to cloning attacks thanks to newly discovered side channel
https://arstechnica.com/?p=2046777
#Yubikey #Yubikey5 #Security #SideChannel #Hacking #Hack #SecOps #ninjalab