Local side channel attack on RSA

Title	Local side channel attack on RSA
CVE	(none)
Date	7th of July, 2021
Affects	All versions of Mbed TLS
Impact	A powerful local attacker can extract the private key
Severity	High
Credit	Zili Kou, Wenjian He, Sharad Sinha, and Wei Zhang

Vulnerability

The modular exponentiation operation in RSA uses a sliding window algorithm, with a memory access pattern that depends on the bits of the secret key.

Exponent blinding is used as a counter-measure: it prevents an attacker from correlating informations gathered on successive operation, but researchers found a way to recover enough information by observing a single operation, therefore by-passing this counter-measure.

Impact

An attacker with access to precise enough timing and memory access information (typically an untrusted operating system attacking a secure enclave such as SGX or the TrustZone secure world) can recover the private keys used in RSA.

Resolution

Affected users will want to upgrade to Mbed TLS 3.0.0, 2.27.0 or 2.16.11 depending on the branch they’re currently using.

Work-around

None.