Security is hard
-
Security is hard.
The TL;DR is: Do not lose possesion of your private key.
The attack requires physical access to the secure element (few local electromagnetic side-channel acquisitions, i.e. few minutes, are enough) in order to extract the ECDSA secret key. In the case of the FIDO protocol, this allows to create a clone of the FIDO device.
All YubiKey 5 Series (with firmware version below 5.7) are impacted by the attack and in fact all Infineon security microcontrollers (including TPMs) that run the Infineon cryptographic library (as far as we know, any existing version) are vulnerable to the attack.
https://www.yubico.com/support/security-advisories/ysa-2024-03/
-
System shared this topic
-
Security is hard.
The TL;DR is: Do not lose possesion of your private key.
The attack requires physical access to the secure element (few local electromagnetic side-channel acquisitions, i.e. few minutes, are enough) in order to extract the ECDSA secret key. In the case of the FIDO protocol, this allows to create a clone of the FIDO device.
All YubiKey 5 Series (with firmware version below 5.7) are impacted by the attack and in fact all Infineon security microcontrollers (including TPMs) that run the Infineon cryptographic library (as far as we know, any existing version) are vulnerable to the attack.
https://www.yubico.com/support/security-advisories/ysa-2024-03/
Interesting. The server side software used to preview the first link that was not 404, and that did not happen in this case.
-
Security is hard.
The TL;DR is: Do not lose possesion of your private key.
The attack requires physical access to the secure element (few local electromagnetic side-channel acquisitions, i.e. few minutes, are enough) in order to extract the ECDSA secret key. In the case of the FIDO protocol, this allows to create a clone of the FIDO device.
All YubiKey 5 Series (with firmware version below 5.7) are impacted by the attack and in fact all Infineon security microcontrollers (including TPMs) that run the Infineon cryptographic library (as far as we know, any existing version) are vulnerable to the attack.
https://www.yubico.com/support/security-advisories/ysa-2024-03/
@SpaceLifeForm
Interesting read
Thanks for sharing -
@SpaceLifeForm
Interesting read
Thanks for sharing
