search

openssl / openssl

TLS/SSL and crypto library
https://www.openssl.org
Apache License 2.0
24.46k stars 9.85k forks source link

Minerva attack on s390x architecture #24252

Open GeorgePantelakis opened 1 month ago

GeorgePantelakis commented 1 month ago

@tomato42 and I have tested OpenSSL in s390x architecture with z15 microarchitecture and we found that it may be vulnerable to a variant of the Minerva attack. We used statistical analysis to confirm the presence of side channels but we did not perform the Minerva attack against the implementation.

In the test scenario, we measure the time of signing of random messages using the EVP_DigestSign API (Init, Update, and Final) and then use the private key to extract the K value (nonce) from the signatures. Then based on the bit size of the extracted nonce we compare the signing time of full-sized nonces to signatures that used smaller nonces using statistical tests.

In our initial test, we found side-channels in curves P-256, P-364, and P-521. In these results we can see a clear leak: there is a dependency between the bit size of K and the size of the side channel.

For the non-deterministic path of the code: conf_interval_plot_all_k_sizes_trim_mean_45_0-10 Results for P-256. Skilling-Mack test p-value: 0. The sample tested has 143,963,933 observations.

conf_interval_plot_all_k_sizes_trim_mean_45_0-10 Results for P-384. Skilling-Mack test p-value: 0. The sample tested has 143,966,184 observations.

conf_interval_plot_all_k_sizes_trim_mean_45_0-10 Results for P-521. Skilling-Mack test p-value: 0. The sample tested has 143,961,342 observations.

For the deterministic path of the code: conf_interval_plot_all_k_sizes_trim_mean_45_0-10 Results for P-256. Skilling-Mack test p-value: 0. The sample tested has 143,961,755 observations.

conf_interval_plot_all_k_sizes_trim_mean_45_0-10 Results for P-384. Skilling-Mack test p-value: 1.180236e-133. The sample tested has 143,952,618 observations.

conf_interval_plot_all_k_sizes_trim_mean_45_0-10 Results for P-521. Skilling-Mack test p-value: 8.712206e-06. The sample tested has 143,961,258 observations.

t8m commented 1 month ago

In comparison to the PPC64 and ARM results here the signal is much bigger (tenths of ns).

holger-dengler commented 1 month ago

We'll take a look.

holger-dengler commented 1 month ago

After analysis it has been determined not to be an issue in OpenSSL. IBM Z and LinuxONE customers are advised to stay current with their service and refer to the IBM Z and LinuxONE Security Portal for information about security vulnerabilities. See also https://www.ibm.com/support/pages/ibm-security-vulnerability-management .