Achilles: A Formal Framework of Leaking Secrets from Signature Schemes via...
summary
Achilles formalizes Rowhammer fault injection against a generalized signature scheme G-sign, automates symbolic differential analysis and secret recovery, and finds vulnerabilities in six signature schemes including two newly vulnerable EdDSA parameters. It uses memory profiling, double-sided Rowhammer, and a tool called auto-war to enumerate exploitable parameter faults, requires as few as 40 signatures for some schemes and hundreds for others, and demonstrates successful end-to-end key recovery against libraries wolfssl, relic, and liboqs.
AI-written summary · about
chapters (13)
- 0:00Introduction to Achilles
- 1:14Signature schemes overview
- 2:41Core signature functions
- 3:23Attack model formalized
- 4:09Public vs secret faults
- 5:13Secret recovery algorithms
- 6:40Symbolic automation
- 8:09AutoWar vulnerability detection
- 8:52Memory profiling setup
- 9:35Online injection process
- 10:17Recovering remaining bits
- 11:01Countermeasures and bypasses
- 11:43Comparison with fault attacks
related talks
47mThreshold Signatures and Fault Attacks
24mA Decade After Bleichenbacher '06, RSA Signature Forgery Still Works
41mFault Attacks & Side Channels
51mExploiting Hardware Glitches And Side Channels In Perfect Software
52mSecuring The Unseen: Vulnerability Research In Confidential Computing
49mDigital Signatures
28mFlip Feng Shui: Hammering a Needle in the Software Stack
54mBroken Crypto is Broken