Side-Channel Attack on Libgcrypt Allows RSA Key Recovery

5.7.2017 securityweek  Krypto

The developers of Libgcrypt, the cryptographic library used by the GNU Privacy Guard (GnuPG) implementation of the OpenPGP standard, released an update last week to prevent side-channel attacks that allow the recovery of RSA private keys.

The attack method was identified recently by a team of researchers from various universities in Australia, the Netherlands and the United States.

They showed that the use of the sliding windows method for exponentiation leads to the leakage of exponent bits. It’s widely believed that the number of leaked bits is not enough to fully recover an RSA key, but the experts have demonstrated that extraction of RSA-1024 keys is possible, and even RSA-2048 keys in 13 percent of cases.

The research targeted Libgcrypt version 1.7.6 and the attack was conducted on an HP-Elite 8300 computer, with a 4-core Intel i5-3470 processor and 8GB of DDR3-1600 memory.

The developers of Libgcrypt have been notified of the vulnerability, tracked as CVE-2017-7526. They addressed the issue, which they described as a local side-channel attack, with the release of version 1.7.8.

Libgcrypt maintainers pointed out that this attack method requires running malicious software on the machine storing the targeted private RSA key. If this type of access is obtained, there are easier ways to recover the key than to launch such a side-channel attack.

“Allowing execute access to a box with private keys should be considered as a game over condition, anyway,” Libgcrypt developers said in an advisory. “However, on boxes with virtual machines this attack may be used by one VM to steal private keys from another VM.”

The developers of the Debian and Ubuntu Linux distributions have also released updates to address the vulnerability.

Technical details on this attack method can be found in the paper titled “Sliding right into disaster: Left-to-right sliding windows leak,” published on the website of the International Association for Cryptologic Research (IACR).