1
00:00:08,320 --> 00:00:12,960
Are you seeing us, sir?

2
00:00:17,620 --> 00:00:19,880
Okay, we're good.

3
00:00:20,620 --> 00:00:28,960
Alright guys, we have Ellie Burstyn here to talk to us today about Hacker's Guide to Side Channels.

4
00:00:29,060 --> 00:00:36,000
And with that, I'd like to turn it over to you to have any sort of first questions, or first answers.

5
00:00:36,000 --> 00:00:39,120
And we'll start taking questions on the Discord channel.

6
00:00:39,120 --> 00:00:41,320
So, thank you for joining us.

7
00:00:41,420 --> 00:00:44,420
And any sort of open remarks or anything?

8
00:00:46,920 --> 00:00:48,800
Thank you for watching the talk.

9
00:00:49,220 --> 00:00:51,380
I would have loved to do it in person.

10
00:00:51,380 --> 00:00:58,740
I kind of miss the DevCon ambience, but I hope we'll try to have a good chat, ask anything you want, and try to do my best.

11
00:00:59,320 --> 00:01:01,620
And again, thank you so much for watching the talk.

12
00:01:03,740 --> 00:01:06,140
So, I guess I'll start off.

13
00:01:06,140 --> 00:01:23,300
I think you did a good job in the talk, talking about the sort of why of machine learning, and why the model predicted... or why machine learning decided the way it decided, if that makes sense.

14
00:01:23,300 --> 00:01:30,020
And why the model predicted what it predicted in order to understand how a defender would react to that.

15
00:01:30,020 --> 00:01:32,680
I don't know if you want to elaborate on that talk.

16
00:01:32,680 --> 00:01:33,540
I've never sort of...

17
00:01:33,540 --> 00:01:37,340
I've never thought of machine learning...

18
00:01:37,340 --> 00:01:46,960
you think of machine learning, judging it on what the outcome of it is, not what led to that outcome, and what defense to build from it.

19
00:01:46,960 --> 00:01:53,360
So, I don't know if you want to comment on that thought, or if it even makes sense, what I just asked.

20
00:01:53,420 --> 00:01:54,320
No, it does.

21
00:01:54,320 --> 00:01:54,680
It does.

22
00:01:54,680 --> 00:01:55,280
It does.

23
00:01:56,700 --> 00:02:01,100
I think we have a lot of security tools for debugging.

24
00:02:01,100 --> 00:02:05,280
I think if you want to debug a C++ program, we have debugger.

25
00:02:05,740 --> 00:02:09,120
We have Python debugger, C++ debugger.

26
00:02:09,980 --> 00:02:17,180
Most of the things we can debug, because we have a way to introspect where the bug is triggered.

27
00:02:17,180 --> 00:02:23,220
The systems, the entire stack is developed around error handling.

28
00:02:23,440 --> 00:02:25,540
The problem is how the crypto is.

29
00:02:25,540 --> 00:02:34,020
You run a crypto algorithm on the hardware, and you have no idea why information is taken.

30
00:02:34,060 --> 00:02:34,920
You have a leak.

31
00:02:34,920 --> 00:02:40,680
You know that the machine learning is finding the correct key, or the correct attack point.

32
00:02:40,940 --> 00:02:49,540
And you're like, OK, I developed this kind of implementation, and we do at Google have our own cryptographic chip, so that's something we're very concerned about.

33
00:02:49,540 --> 00:02:54,880
And everyone who has a crypto chip is interested in that question of, OK, you have a leak, but then what?

34
00:02:55,300 --> 00:03:03,620
And prior to machine learning, we didn't have a technique, or we didn't have a tool, where you can ask, why?

35
00:03:03,620 --> 00:03:05,020
Why do you predict what you do?

36
00:03:05,300 --> 00:03:08,280
This is kind of like a crazy thing about the machine learning thing.

37
00:03:08,280 --> 00:03:11,760
It does things which we can't do otherwise.

38
00:03:11,760 --> 00:03:14,960
It's not ideal, because, you know, we all say, well, machine learning is a black box.

39
00:03:14,960 --> 00:03:16,380
That's completely true.

40
00:03:16,640 --> 00:03:21,700
But the only thing we have, which is like, OK, can you please tell me why?

41
00:03:22,200 --> 00:03:26,300
The why is a little bit easy, but it's like, why?

42
00:03:26,340 --> 00:03:35,800
And then we thought, OK, since we moved from site-generator using statistical estimates to machine learning, and we talked about it last year at DEF CON, it works really well.

43
00:03:36,000 --> 00:03:38,820
Can we go one step further and try to also ask the model why?

44
00:03:38,820 --> 00:03:40,480
And then you can do that.

45
00:03:40,480 --> 00:03:43,160
And as I said, it's very, very brittle.

46
00:03:43,760 --> 00:03:48,000
You have to be super, super precise, and we make it work for one implementation.

47
00:03:48,220 --> 00:03:50,880
And, you know, it's a tool, so obviously we're going to show you the best case.

48
00:03:50,880 --> 00:04:00,580
The truth of the matter is, you know, you have to really be super precise, which is like CPU instruction precise, so it's not super robust just yet, but you can do that.

49
00:04:00,580 --> 00:04:02,840
And I think that's the only tool in the world who can do that.

50
00:04:02,840 --> 00:04:05,220
That's why Scaled is one of its kind.

51
00:04:05,220 --> 00:04:07,140
It's the first generation of it.

52
00:04:07,340 --> 00:04:12,440
You know, five years, ten years from now, we'll be laughing at it and be like, OK, we've got a way to do it, I'm pretty sure.

53
00:04:12,760 --> 00:04:22,860
But it was two crazy years of brainstorming and trying ideas until we came up with an idea of doing it.

54
00:04:22,860 --> 00:04:24,480
It came out of necessity.

55
00:04:24,480 --> 00:04:34,940
It came out from our project team inside Google of like, OK guys, you make better attacks, which was not the goal, but the goal of our whole project was to make a better world, like a more secure world.

56
00:04:35,100 --> 00:04:47,520
I didn't have to pitch a choir, and then we really wanted to make a tool for our engineering team of like, and around the world of like, OK, here's a tool you can use, here's a tool lab, here's a debugger for hardware crypto.

57
00:04:47,520 --> 00:04:49,120
And it just doesn't exist.

58
00:04:49,120 --> 00:04:51,600
So that's where it comes from.

59
00:04:51,640 --> 00:04:55,980
And without machine learning, it doesn't work, but without the relations, it doesn't work, and without the community, it doesn't work.

60
00:04:55,980 --> 00:04:59,620
We use a lot of the technology behind the scenes, like Unicorn.

61
00:04:59,760 --> 00:05:02,180
And we had a pretty good talk today about Unicorn as well.

62
00:05:02,180 --> 00:05:11,920
A lot of people are using Unicorn, which is a CPU emulator, which is very close to the community, so we are standing on shoulder of giants, which is bringing some of the interesting twists to it.

63
00:05:13,040 --> 00:05:14,160
That's what it is.

64
00:05:15,520 --> 00:05:16,240
Great.

65
00:05:16,240 --> 00:05:27,640
So actually, just jumping off what you said, are people actually using this to help identify side channels yet, or have you been approached by anyone?

66
00:05:27,640 --> 00:05:28,660
No, not yet.

67
00:05:30,800 --> 00:05:40,480
To be clear, we had a lot of debate actually internally, because it's really super out of the press.

68
00:05:40,480 --> 00:05:46,180
I would say the initial complete success was probably one or two weeks old.

69
00:05:46,180 --> 00:05:51,260
We knew it was somewhat working, but we didn't get it to work as clearly as it should.

70
00:05:51,260 --> 00:05:55,480
It took like, I think maybe 24 hours before I recorded the talk to be clear.

71
00:05:56,540 --> 00:06:02,800
But we saw that DevCon is virtual, we really want to contribute, we really want to be part of the community.

72
00:06:03,640 --> 00:06:18,520
Usually we're not really good at things ahead of what we do, but this year we saw that we wanted to really show you the trading engine, what we were working on as a way to participate and to be part of the community.

73
00:06:18,620 --> 00:06:21,040
So , no, it's not there yet.

74
00:06:21,040 --> 00:06:22,720
The research effort is not there yet.

75
00:06:22,760 --> 00:06:25,240
I'm sure the COVID question is going to come, so I'll answer.

76
00:06:25,340 --> 00:06:27,120
Yes, the code will be public next week.

77
00:06:27,120 --> 00:06:30,980
I'm still cleaning up the GitHub to tell you how new it is.

78
00:06:31,300 --> 00:06:34,900
But we went for, here is something new and exciting that we work on.

79
00:06:34,900 --> 00:06:39,840
You guys might get a kick out of looking at it and be inspired, and that's what we go for.

80
00:06:40,200 --> 00:06:42,480
So, the talk, sometime I'm bumping into the middle of it.

81
00:06:42,700 --> 00:06:43,840
Sorry about that, too.

82
00:06:43,960 --> 00:06:45,840
I tried to record it with the door closed.

83
00:06:45,840 --> 00:06:50,980
In California, it's like 28 degrees in the room when I try to record, so I was straining a little bit.

84
00:06:50,980 --> 00:06:52,600
I apologize also for my English.

85
00:06:53,180 --> 00:06:59,540
But, yeah, we really tried to do like, this is the state mode talk, which is like, we do show you bleeding edge.

86
00:06:59,540 --> 00:07:02,260
Like, it's a true, you know, very old DevCon spirit.

87
00:07:02,260 --> 00:07:04,640
Like, this is new, we're here to transform it.

88
00:07:04,640 --> 00:07:05,500
That's what it was.

89
00:07:05,500 --> 00:07:06,320
So, no, it's not here.

90
00:07:06,320 --> 00:07:07,880
Absolutely not.

91
00:07:12,300 --> 00:07:14,100
That's great.

92
00:07:14,740 --> 00:07:23,360
So, the example we're using were mostly around power, if I understood the presentation right.

93
00:07:23,360 --> 00:07:30,460
And, you know, you mentioned other side channels, you know, heat, emissions, timing, etc.

94
00:07:30,460 --> 00:07:39,060
I mean, do you see these techniques would apply to all those, or there wasn't anything unique to the instrumentation you used, right?

95
00:07:39,620 --> 00:07:43,160
No, I don't see there's anything special to it.

96
00:07:43,480 --> 00:07:47,660
I never used, I said, I don't know if anyone ever used heat.

97
00:07:47,660 --> 00:07:54,140
I would be super curious if someone knows about a heat attack, timing attack, which is super, super interesting.

98
00:07:54,140 --> 00:07:55,340
I've never seen one.

99
00:07:55,720 --> 00:07:58,900
Like, in crypto, they might exist, I don't know.

100
00:07:58,900 --> 00:08:04,540
But we thought about, yeah, magnetic, I think, is one of the big deal.

101
00:08:07,580 --> 00:08:10,140
We wanted to do this here, to be clear.

102
00:08:10,600 --> 00:08:13,500
And extend what we do from power to EM as well.

103
00:08:13,880 --> 00:08:23,140
The truth of the matter is, we cannot go to the office, right, doing remote work in our team, as many of us are doing in the community, and we don't have access to our equipment, right.

104
00:08:23,140 --> 00:08:27,120
The only thing we can really do is power, because that's what is plugged into our lab.

105
00:08:27,320 --> 00:08:30,660
And the only thing we can access remotely to do is EM.

106
00:08:30,660 --> 00:08:34,220
You have to literally have an EM table, and you have to be on top of the chip.

107
00:08:34,460 --> 00:08:37,320
And that is not doable in the near future.

108
00:08:37,320 --> 00:08:38,840
So, we'd love to do EM.

109
00:08:39,580 --> 00:08:42,520
I think the next big target is that.

110
00:08:42,680 --> 00:08:45,640
You would do, maybe timing.

111
00:08:45,640 --> 00:08:47,240
Timing might work too, probably.

112
00:08:47,240 --> 00:08:57,460
I think there is a few papers coming out this year from other groups on machine learning and timing attacks for Parasite, I believe.

113
00:08:57,840 --> 00:09:01,920
I don't think we'll be able to cure it, so I think it will most likely show that you can use machine learning for that.

114
00:09:02,000 --> 00:09:10,700
So, as I said, machine learning is an easier way to take over such an attack for hardware in the next 2-3 years than when it's going to do it.

115
00:09:11,080 --> 00:09:14,140
We just happened to be the first few groups who are doing it.

116
00:09:14,140 --> 00:09:15,480
There are other groups in France.

117
00:09:17,240 --> 00:09:19,620
There's a German group as well who is doing some of it.

118
00:09:19,880 --> 00:09:23,860
Some vendors are taking some of the research and putting it into products.

119
00:09:23,860 --> 00:09:25,160
I think that's where it's going to go.

120
00:09:25,160 --> 00:09:29,280
But I think most people are on the power train for now.

121
00:09:29,300 --> 00:09:32,440
Maybe a little bit of timing attack is pretty new this year.

122
00:09:32,720 --> 00:09:34,400
I guess the end is the next.

123
00:09:34,480 --> 00:09:39,340
Yeah, I was wondering that too.

124
00:09:39,340 --> 00:09:43,760
It's kind of, as you were saying, you built your model, I guess, using mostly an emulator.

125
00:09:44,040 --> 00:09:47,680
How well does that scale then to other hardware?

126
00:09:47,700 --> 00:09:50,820
Is it kind of the research you've done, it's that one sample?

127
00:09:50,820 --> 00:09:56,180
Or do you think that you're going to need to build your machine learning models for different types of processors or setups, right?

128
00:09:56,180 --> 00:09:57,140
Does that make sense?

129
00:09:57,400 --> 00:10:01,120
Yeah, so for the attack side, we know it works.

130
00:10:01,420 --> 00:10:06,900
I mean, I hope it's not a unique paper, but since last year we've been working.

131
00:10:06,900 --> 00:10:13,420
The last three years we have collected a massive set of data sets that we really hope to publish.

132
00:10:13,420 --> 00:10:15,100
I'm not going to give a date at that point.

133
00:10:15,100 --> 00:10:17,580
Last year I said very soon, and it didn't happen this year.

134
00:10:17,800 --> 00:10:19,320
Or the next year we have.

135
00:10:19,320 --> 00:10:23,560
But yes, we have that for multiple data sets, multiple hardware that works.

136
00:10:23,640 --> 00:10:32,660
For the emulation side, the other side, which is not the machine learning side, the dynamic analysis where we need to be site-precise, we don't even have a normal.

137
00:10:32,660 --> 00:10:47,760
And the thing is, Intel is, for example, out of the question because they have a predictive pipeline, so we don't even know, like, depending on how the Intel predictive pipeline will work or the flush pipeline will work, the number of instructions is completely non-deterministic.

138
00:10:47,760 --> 00:10:51,200
Or at least to the point where, in our poor brain, we're not going to be able to do it just yet.

139
00:10:51,420 --> 00:10:54,460
So if your CPU is too complicated, I don't think we can.

140
00:10:55,420 --> 00:11:05,480
Reduce set instructions should work, I guess, but like I said, we don't even have a device now because it's like, oh, it's between, I don't know what the range is, 2 to 12 cycles.

141
00:11:05,480 --> 00:11:08,700
So we have to make an estimated guess.

142
00:11:08,700 --> 00:11:12,520
So it works for ARM, mostly embedded stuff, I assume.

143
00:11:12,520 --> 00:11:14,720
Smaller power would work too.

144
00:11:15,300 --> 00:11:31,620
But yes, the emulation side of it is hard because if you're off, you know, if your machine learning is correct, it finds the attack, then if you're off for the cycle for the emulation, you end up, I don't know, like, 6, 12, 15, 100 cycles left or right,

145
00:11:31,620 --> 00:11:33,940
and then you're on the wrong line of code, right?

146
00:11:33,940 --> 00:11:43,740
The line of code that I said is true for instructions, so you might have, you know, you might get lucky if you're a little bit slowly, but that margin becomes terrifyingly hard.

147
00:11:43,740 --> 00:11:52,180
And similarly, there is a back point at the end of the... you can also apply the end of the implementation, not the first round, but the end.

148
00:11:52,180 --> 00:11:56,360
And then, again, at that point, every error is compounded, right?

149
00:11:56,360 --> 00:12:03,580
So the further you undertrace on the right side of this, the more you're going to have a chance of mixing it up.

150
00:12:03,800 --> 00:12:16,360
So yes, we choose easy case, which is like very well-defined ARM, which is a very small set of instructions, well-defined, well-documented, on an easy C non-vectorized, because that's the easy case.

151
00:12:17,260 --> 00:12:20,640
Harder case would be like more features of engineering.

152
00:12:20,640 --> 00:12:26,920
I think the people in the committee are interested to help us improve the analyzer or add more targets.

153
00:12:26,920 --> 00:12:32,080
It's probably doable, it's just going to be interesting reversing engineering exercise, right?

154
00:12:32,400 --> 00:12:33,900
And that's what people put at hardware.

155
00:12:33,900 --> 00:12:37,220
It's fun to do, it's just, it's going to be quite worse.

156
00:12:38,640 --> 00:12:40,140
It's a really good question.

157
00:12:41,820 --> 00:12:51,160
Yeah, so, I mean, the attacks themselves are pretty hard, so it goes to show that the defensive analysis would be just as hard, right?

158
00:12:54,160 --> 00:13:03,480
Yeah, I mean, we know that hardware, I mean, we know that stationary attacks are inevitable, right?

159
00:13:03,480 --> 00:13:04,640
Almost inevitable.

160
00:13:04,640 --> 00:13:12,780
There are defenses which might exist, like doubling the bus for power supply, power attack, but that's not going to be implemented in hardware.

161
00:13:12,780 --> 00:13:16,360
It's too expensive or too costly or too big.

162
00:13:16,720 --> 00:13:20,360
So, everything is inevitable to size your attack to an extent.

163
00:13:20,640 --> 00:13:23,720
The question is, how can we make it right?

164
00:13:23,720 --> 00:13:34,620
There are really cool set of work done mostly by the French ANSI on MASSKS which is kind of like the way you make it harder.

165
00:13:34,780 --> 00:13:36,580
You can also make it slower.

166
00:13:37,260 --> 00:13:42,160
So, the question is, how slow can be hardware encryption, right?

167
00:13:42,160 --> 00:13:44,740
The question is, how many milliseconds can you tolerate?

168
00:13:45,100 --> 00:13:51,560
The reason why I mention that is, if you use security keys, right, we create security keys, they use NFC.

169
00:13:51,560 --> 00:13:54,620
And the problem with NFC, NFC is super fast and super low power.

170
00:13:54,620 --> 00:13:59,680
So, now, in those settings, making a super resilient implementation is going to be challenging.

171
00:13:59,920 --> 00:14:05,840
So, being said, this is not AES as we show, but even for that you cannot switch out.

172
00:14:06,000 --> 00:14:08,860
If you want APK, also you cannot switch out.

173
00:14:10,180 --> 00:14:12,280
Well, I don't have a lot of time.

174
00:14:12,520 --> 00:14:13,860
I don't have a lot of power.

175
00:14:14,600 --> 00:14:19,060
And with more computation to harden my thing, that becomes kind of impossible.

176
00:14:19,060 --> 00:14:20,700
So, there will always be a trade-off, right?

177
00:14:20,700 --> 00:14:23,640
And as long as there is a trade-off, there is a vulnerability.

178
00:14:23,960 --> 00:14:33,840
So , you know, Tyler's channel attack is probably the most powerful attack you can do against cryptos these days because this is the one where we know we cannot solve it.

179
00:14:33,840 --> 00:14:35,380
So, interesting.

180
00:14:35,380 --> 00:14:37,600
It's an interesting space.

181
00:14:37,840 --> 00:14:43,100
Pretty interesting.

182
00:14:43,400 --> 00:14:47,600
Yeah, and I'll say, I really appreciated your talk, too, how you went through the different steps.

183
00:14:47,600 --> 00:14:50,120
It was very informative and instructive.

184
00:14:50,180 --> 00:14:56,860
Like, even just mentioning explainers, you did a very good job of explaining everything and really showing the real world examples.

185
00:14:57,140 --> 00:15:00,540
You say, though, you say side-channel attacks are really important for encryption.

186
00:15:00,540 --> 00:15:03,080
How did you get into the side-channel attack space?

187
00:15:03,080 --> 00:15:04,080
What drew you to that?

188
00:15:04,080 --> 00:15:05,620
Was it the encryption aspect?

189
00:15:05,620 --> 00:15:09,640
How did your research end up on side-channel attacks?

190
00:15:10,700 --> 00:15:12,080
Oh, wow.

191
00:15:14,850 --> 00:15:16,410
That's a hard question.

192
00:15:16,850 --> 00:15:25,950
I think what happened is before, I always did cryptanalysis.

193
00:15:27,390 --> 00:15:35,010
People might or might not remember it, but a few years back, we announced the first collision on SHA-1.

194
00:15:35,750 --> 00:15:39,550
And we did it all at that time.

195
00:15:41,230 --> 00:15:43,110
And it took us a while.

196
00:15:43,110 --> 00:15:44,630
It took us a while to do it.

197
00:15:44,630 --> 00:15:49,230
Breaking SHA-1 in collaboration with Mark Stevens, the CWI, took three years.

198
00:15:49,610 --> 00:15:52,910
Most people don't realize that sometimes when we do talk, it's like, oh, that's great.

199
00:15:52,910 --> 00:15:53,550
That's nice.

200
00:15:53,550 --> 00:15:58,250
It took three years of effort for us, and I think Mark spent almost ten years on it.

201
00:15:58,250 --> 00:16:12,970
So you get out of breaking SHA-1 I mean, putting it in practice, it was broken by one, but like providing the first collision, and then, as I said, in 2015 we did the first collision.

202
00:16:12,970 --> 00:16:18,750
We showed these two PDFs which are about to send SHA-1, and then the world did break SHA-1, which was our goal.

203
00:16:19,530 --> 00:16:36,890
Interestingly enough, the backstory, the reason why we decided to do it is not to do a talk, but because we really wanted to help people realize that they need to move away from it at the time Microsoft, XCOR, did not deprecate it and Firefox was lagging,

204
00:16:36,890 --> 00:16:51,390
and it had the immediate effect that both of them immediately deprecated it, so it was like why would you ever go into this crazy amount of money and amount of energy to literally compute all this?

205
00:16:51,390 --> 00:17:01,890
And the answer was because, at that time, we wanted to show to the world, it was with both Microsoft and XCOR, and we should treat it seriously.

206
00:17:01,890 --> 00:17:14,170
Again, it was important to get this always in the context of our team, the research team, we tried to set up an XOR where people come up to this project and try to figure out if it can help the world.

207
00:17:14,270 --> 00:17:19,670
And then we finished that, and we were like, okay what else?

208
00:17:19,930 --> 00:17:27,910
And then, so yeah, our first research team is almost a hangover because we had to get professional marketing and we were like, what's next?

209
00:17:28,250 --> 00:17:31,330
A piece of crypto, and then we were like, okay what's next?

210
00:17:32,010 --> 00:17:41,930
And then we started to talk with the project team, and at that time something called the Titan chip, publicly, is developed by Google.

211
00:17:41,930 --> 00:17:43,630
It's Google's own crypto chip.

212
00:17:43,630 --> 00:17:48,150
And the crypto chip we talked to the hardware engineer, and they told us, well, no.

213
00:17:48,690 --> 00:17:58,450
So this crazy idea, we come up with one paper from the French agency, which is the French control agency specializing in crypto.

214
00:17:58,830 --> 00:18:03,150
They have this very, very interesting work on machine learning and crypto, you should check it out.

215
00:18:03,530 --> 00:18:05,670
And I was totally in love with the idea.

216
00:18:06,110 --> 00:18:13,490
The internal team was very interested in having more resources, and then we realized it's very, very powerful, very interesting.

217
00:18:13,490 --> 00:18:18,490
It's played well into what Google do, which is machine learning at the time, it's here.

218
00:18:19,170 --> 00:18:23,870
It plays well into core and fundamental research that we do.

219
00:18:23,970 --> 00:18:26,810
It plays well with... that's what we decided to go for.

220
00:18:26,870 --> 00:18:40,690
Honestly, we got from our project team, so it was completely serendipitous, and has been seen in research more like you know, talking to people, and it's like something like that.

221
00:18:40,690 --> 00:18:48,610
You want to talk, you get inspired by other people, you build on other people's work or ideas, and we all keep it to push it further.

222
00:18:48,910 --> 00:18:50,710
So I think that's what it was.

223
00:18:51,070 --> 00:18:56,370
I think that was this idea of come from other people, and take credit for it all.

224
00:18:56,390 --> 00:19:13,070
We met a lot of wonderful people from Ledger, from Chipwister, you know, Colleen, and many Chipwisters by the way, the scaffolding committee, the institutional community, we also have a lot of time to help us, give us pointers early days.

225
00:19:13,070 --> 00:19:17,070
So we're glad that now we're back.

226
00:19:18,470 --> 00:19:20,710
Great, so we have a question from the audience.

227
00:19:20,790 --> 00:19:27,430
Apart from approving the emulation, what do you see as the next step in this field of side-channel detection?

228
00:19:30,970 --> 00:19:31,490
Detection...

229
00:19:34,470 --> 00:19:36,230
That's a great question.

230
00:19:37,950 --> 00:19:39,870
I think there are ...

231
00:19:43,230 --> 00:19:48,530
I think it goes hand-to-hand with better attack.

232
00:19:48,670 --> 00:19:51,270
Again, we can only explain what we can attack.

233
00:19:51,270 --> 00:19:58,870
I think we have a few working streams on public key, and a few working streams on other algorithms.

234
00:19:58,870 --> 00:20:01,130
I think that will be interesting to do.

235
00:20:01,370 --> 00:20:07,370
We're always looking for people who are willing to work with us, because it's a very, very big...

236
00:20:08,950 --> 00:20:15,710
I won't say difficult, but it's a lot of grind to create the data, and to do the machine learning, and that sort of thing.

237
00:20:15,710 --> 00:20:22,330
So if people are interested to collaborate, we're always up for it, because it's a little bit like, figure out what to do, it's hard.

238
00:20:22,490 --> 00:20:25,410
Last year, when I come, I go, it's so hard to do the IAF model.

239
00:20:25,410 --> 00:20:31,190
This year, after a year of refining the machine learning model and our process, we can basically do it in 10 minutes.

240
00:20:31,190 --> 00:20:38,230
So we went from 5 hours to 15 minutes by getting just mechanically better at it.

241
00:20:38,230 --> 00:20:41,210
I think it's going to be the same for the other algorithms.

242
00:20:41,490 --> 00:20:43,630
So I really view that.

243
00:20:43,630 --> 00:20:47,950
I think we're also going to view, I hope, people being creative for it.

244
00:20:49,090 --> 00:20:50,290
I don't know.

245
00:20:50,630 --> 00:20:53,270
I would imagine you can do that timing attack.

246
00:20:53,270 --> 00:20:55,830
Some people mentioned cache line as an idea.

247
00:20:55,830 --> 00:20:57,450
I found that quite interesting.

248
00:20:57,670 --> 00:21:02,030
There is a holy grail of Intel HDX.

249
00:21:02,030 --> 00:21:04,790
I mean, Enclave is also using crypto.

250
00:21:05,570 --> 00:21:10,330
It is crazy hard to attack, because it's literally baked into the Intel CPU.

251
00:21:10,850 --> 00:21:13,990
However, no one knows if machine learning can do it or not.

252
00:21:13,990 --> 00:21:16,550
Some people we talked to say yes, it's probably doable.

253
00:21:16,830 --> 00:21:17,430
I don't know.

254
00:21:17,430 --> 00:21:18,590
I never do it.

255
00:21:18,910 --> 00:21:21,630
We don't have necessarily the time to do it by ourselves.

256
00:21:21,630 --> 00:21:25,010
We're happy to contribute, but that's something which is interesting line of research.

257
00:21:25,010 --> 00:21:26,990
I think Enclave is a big deal.

258
00:21:27,990 --> 00:21:29,730
Other algorithms are a big deal.

259
00:21:29,730 --> 00:21:31,610
But also we can think of crazy things.

260
00:21:31,610 --> 00:21:33,590
Everything which is timing sounds a bit bad.

261
00:21:34,370 --> 00:21:45,490
I would not be surprised if someone even came up with a crazy idea of how to do it for Bitcoin wallet transactions, or even what would be another interesting step.

262
00:21:45,490 --> 00:21:46,430
SQL injection.

263
00:21:46,530 --> 00:21:48,190
We have a lot of blind SQL injection.

264
00:21:48,690 --> 00:21:51,770
Maybe we can get more out of the timing.

265
00:21:51,770 --> 00:21:54,390
We can make more out of the timing that we think we can.

266
00:21:55,570 --> 00:21:56,510
It's unclear.

267
00:21:56,550 --> 00:22:00,890
I mean, most of them should have been fixed, but yeah, I don't know.

268
00:22:00,890 --> 00:22:03,970
That's a lot of room, a lot of creativity.

269
00:22:04,550 --> 00:22:06,090
It depends on people's taste.

270
00:22:07,350 --> 00:22:08,310
I'm not sure.

271
00:22:09,590 --> 00:22:11,990
So you mentioned a paper is coming out.

272
00:22:12,030 --> 00:22:15,150
Do you have an estimate on when you're going to be done with that?

273
00:22:15,810 --> 00:22:17,650
I'm not going to jinx it, Matt.

274
00:22:17,650 --> 00:22:18,970
I'm not going to do that.

275
00:22:18,970 --> 00:22:20,910
Last year I said it's going to be soon.

276
00:22:21,190 --> 00:22:23,030
The draft is still on my desk.

277
00:22:23,030 --> 00:22:26,710
And for the schedule paper, I'm going to be completely honest.

278
00:22:26,710 --> 00:22:28,630
I told you we rushed to do it for DEF CON.

279
00:22:28,630 --> 00:22:30,270
We really wanted to show you Building Edge.

280
00:22:31,070 --> 00:22:32,750
Literally the paper is not ready yet.

281
00:22:32,750 --> 00:22:35,870
The next step for us is to put everything on GitHub.

282
00:22:36,570 --> 00:22:39,690
I'll post the link on Twitter hopefully next week.

283
00:22:41,510 --> 00:22:44,510
And then we're going to want people to play with it.

284
00:22:44,630 --> 00:22:50,210
We'd rather provide incomplete stuff to people to play, because last year we did the reverse.

285
00:22:50,210 --> 00:22:54,610
We thought we were going to hold, hold, hold, and get everything at once and it didn't work out.

286
00:22:54,610 --> 00:22:56,970
So this year, we're switching the strategy.

287
00:22:57,370 --> 00:22:58,790
I'm going to release early.

288
00:22:59,390 --> 00:23:00,330
Imperfect, but early.

289
00:23:00,330 --> 00:23:02,010
And then the paper will come later.

290
00:23:03,210 --> 00:23:04,010
Completely what?

291
00:23:04,010 --> 00:23:07,530
But yes, the AES datasets we promised last year are still there.

292
00:23:07,530 --> 00:23:11,090
We just haven't got the chance to release them.

293
00:23:11,090 --> 00:23:14,110
And then the schedule paper, you'll be able to play with the code.

294
00:23:14,130 --> 00:23:15,410
Run the code I showed you.

295
00:23:15,410 --> 00:23:16,750
Get the verb I showed you.

296
00:23:16,750 --> 00:23:22,150
And then that will be incomplete, because you'll be like, oh, where are the other attack points?

297
00:23:22,150 --> 00:23:23,070
Not there yet.

298
00:23:23,070 --> 00:23:24,050
Where are the other models?

299
00:23:24,050 --> 00:23:24,770
Not there yet.

300
00:23:24,770 --> 00:23:27,390
They're going to get there when they can.

301
00:23:27,390 --> 00:23:28,690
And I make no promises.

302
00:23:29,430 --> 00:23:32,110
Because I can't I don't know what I can keep or not.

303
00:23:32,110 --> 00:23:36,130
So I try to be a little bit more realistic this year than last year.

304
00:23:36,270 --> 00:23:38,770
I want to achieve good people.

305
00:23:39,050 --> 00:23:42,270
I was going to ask the same thing, so it's definitely on folks' minds.

306
00:23:42,390 --> 00:23:44,130
We do have a question from the chat.

307
00:23:44,370 --> 00:23:50,610
So, you know, are you aware of any side-channel attacks that are found in the wild, right, where attackers are using them?

308
00:23:50,610 --> 00:23:56,330
Or is this more of where we're thinking about how to defend against these attacks before, you know, we see them active?

309
00:23:56,750 --> 00:23:59,750
Oh, side-channel are everywhere.

310
00:24:00,230 --> 00:24:01,490
Side-channel are everywhere.

311
00:24:01,490 --> 00:24:04,550
They're like the most prevalent form of attack for hardware.

312
00:24:05,610 --> 00:24:09,450
Let me try to figure out which one I can tell you which are pretty interesting.

313
00:24:09,550 --> 00:24:11,170
So again, it's not singular.

314
00:24:11,230 --> 00:24:16,530
To put one company like this company is bad, because I'm going to use all of them.

315
00:24:16,690 --> 00:24:21,790
So I start with one of my favorite companies, which I really like, Ledger.

316
00:24:21,950 --> 00:24:28,070
Two years ago, they had away someone from a timing attack on the IoT curve.

317
00:24:28,070 --> 00:24:30,130
This was the example I gave at the beginning of the talk.

318
00:24:30,170 --> 00:24:36,070
And they were able to recover all the Ledger treasure by Bitcoin private key.

319
00:24:36,070 --> 00:24:37,730
So that's a pretty big deal.

320
00:24:38,990 --> 00:24:41,910
There was a timing attack on a game console.

321
00:24:42,350 --> 00:24:44,210
I think it was streaming on Twitch.

322
00:24:44,210 --> 00:24:53,850
I'm not going to give too much detail, but many, many game consoles are protected by crypto.

323
00:24:54,370 --> 00:24:57,650
And there was a timing attack to recover some of those secret keys.

324
00:24:57,990 --> 00:24:59,950
That was earlier generation.

325
00:24:59,950 --> 00:25:06,350
I'm not talking 5 or 4 or Xbox One.

326
00:25:06,350 --> 00:25:12,750
I'm talking previous generation, but there was a timing attack who were used to recover crypto keys.

327
00:25:12,750 --> 00:25:14,250
There was many of them.

328
00:25:14,250 --> 00:25:24,170
There was an AES one a very long time ago used by... I believe it was Dan Bernstein on remote AES.

329
00:25:24,170 --> 00:25:29,050
There was one on cache line attacks on CPUs.

330
00:25:29,050 --> 00:25:31,070
There are so many of them everywhere.

331
00:25:31,310 --> 00:25:33,970
Session attacks are so powerful.

332
00:25:33,990 --> 00:25:38,290
The most powerful form of SQL injection is binary SQL injection.

333
00:25:38,710 --> 00:25:40,150
Sorry, session attack.

334
00:25:40,150 --> 00:25:46,010
Binary SQL injection is when you have a SQL injection, but you can't see the output when you trigger.

335
00:25:46,330 --> 00:25:51,050
You do it one character at a time and you just look at whether the server responds or not.

336
00:25:51,050 --> 00:25:52,690
That's a form of session attack.

337
00:25:52,910 --> 00:25:54,070
They are everywhere.

338
00:25:54,270 --> 00:26:00,850
It's a super, super practical attack and usually people are really annoyed and say it's not a good attack because it's a known technique.

339
00:26:00,850 --> 00:26:02,010
It's not a known technique.

340
00:26:02,010 --> 00:26:02,810
It's a known technique.

341
00:26:02,810 --> 00:26:08,770
It just happens that it works super, super efficiently on many, many things.

342
00:26:09,770 --> 00:26:10,970
Yep.

343
00:26:12,550 --> 00:26:20,830
And we have it on physical stuff like electronic locks and things like that.

344
00:26:26,150 --> 00:26:27,830
Oh, I forgot.

345
00:26:27,930 --> 00:26:31,750
I thought that was the most important one.

346
00:26:31,750 --> 00:26:32,810
I'm sorry.

347
00:26:33,630 --> 00:26:35,430
Spectre and Meltdown.

348
00:26:36,030 --> 00:26:37,030
Right.

349
00:26:37,030 --> 00:26:37,690
Spectre and Meltdown.

350
00:26:37,690 --> 00:26:38,630
There you go.

351
00:26:38,770 --> 00:26:40,750
The thing which completely destroys your CPU.

352
00:26:40,750 --> 00:26:43,270
They are a form of session attack.

353
00:26:43,270 --> 00:26:44,010
So here you go.

354
00:26:44,190 --> 00:26:55,770
As I said, some of the most powerful concrete attacks we've seen in the last few years are session attacks because they are so hard to debug, so hard to pull off, to defend against.

355
00:26:55,770 --> 00:26:59,690
Yeah, I think I read something about those.

356
00:27:00,390 --> 00:27:02,150
They were kind of big, right?

357
00:27:02,590 --> 00:27:07,230
Yeah, I pinned in the chat the article.

358
00:27:07,230 --> 00:27:10,030
There's a weird article who can outline that.

359
00:27:10,030 --> 00:27:13,610
It would be good to just read up if you guys are interested.

360
00:27:16,030 --> 00:27:17,310
I think it's QA.

361
00:27:17,310 --> 00:27:17,750
There you go.

362
00:27:17,750 --> 00:27:18,410
Thank you.

363
00:27:18,870 --> 00:27:19,490
Yep.

364
00:27:20,550 --> 00:27:22,450
Yeah, so we've got a couple minutes left.

365
00:27:22,450 --> 00:27:25,430
If we have any more questions, let's get them in here.

366
00:27:25,710 --> 00:27:34,630
Otherwise, we're going to thank Ellie and let you guys get back to the con.

367
00:27:35,530 --> 00:27:37,390
One last one for me.

368
00:27:38,090 --> 00:27:40,270
Oh, wait, we actually do have one more.

369
00:27:41,530 --> 00:27:44,110
Yeah, so someone who is mainly focused in InfoSec.

370
00:27:44,830 --> 00:27:55,450
What kind of background do you think people kind of lend themselves to going towards looking at side-channel attacks and thinking about the research you're doing with being able to detect that in different ways?

371
00:27:57,270 --> 00:27:58,690
What kind of background?

372
00:28:00,590 --> 00:28:01,910
It varies.

373
00:28:04,510 --> 00:28:09,930
We have some people who come from radio.

374
00:28:11,230 --> 00:28:25,430
For those who don't know, the first initial side-channel attack was actually in the 1940s or something like that, where they had a typewriter and the guy was having an oscilloscope, and then he sort of blinked on the oscilloscope and realized that there was something.

375
00:28:25,650 --> 00:28:33,330
And then the Russians put a user to spy onto people by looking at vibrations.

376
00:28:33,330 --> 00:28:34,690
So that's super old stuff.

377
00:28:34,690 --> 00:28:35,930
So that's the radio guys.

378
00:28:35,930 --> 00:28:41,570
The radio guys know a lot about all these electromagnetic things and spycraft there.

379
00:28:41,570 --> 00:28:43,370
So a lot of spycraft comes from that.

380
00:28:43,450 --> 00:28:46,430
We have people who do side-channel attacks who come from hardware.

381
00:28:46,570 --> 00:28:53,750
Hardware people who like to build CPUs and look into meldons, vectors, cache lines.

382
00:28:53,750 --> 00:28:56,510
So those guys also do side-channel attacks in a different way.

383
00:28:56,570 --> 00:29:02,290
We have cryptographers, people who are from a crypto background like me, who are more into that.

384
00:29:03,050 --> 00:29:04,670
So it really depends on your use case.

385
00:29:04,670 --> 00:29:10,590
You have people who do web security with side-channel attacks and side-channel attacks means more SQL injection.

386
00:29:10,770 --> 00:29:15,410
So I think everyone can touch it by the band.

387
00:29:16,050 --> 00:29:17,850
It's fairly easy to get into it.

388
00:29:17,850 --> 00:29:20,710
I think there is this apprehension sometimes.

389
00:29:21,190 --> 00:29:25,910
The first time I read a paper about it, I probably didn't get the best paper to read as an intro.

390
00:29:25,910 --> 00:29:27,930
It felt very bizarre to me.

391
00:29:27,930 --> 00:29:30,470
I didn't really understand what they were going for.

392
00:29:30,870 --> 00:29:38,290
I was a little bit like... it took me three to four months to get used to the mindset of it.

393
00:29:38,290 --> 00:29:39,930
I think it's a very powerful mindset.

394
00:29:39,930 --> 00:29:42,270
I think it's a very fun experience to do.

395
00:29:43,190 --> 00:29:59,110
If you are interested in side-channel attacks, specifically on hardware, and you want to start without machine learning, like more simple stuff like SSTC code, CheapWhisper, which is a thing that is very affordable and even you don't need the whole thing,

396
00:29:59,110 --> 00:30:03,230
you can just run out of existing traces, has a super cool tutorial.

397
00:30:03,490 --> 00:30:10,030
I think Corning from CheapWhisper has put a tremendous amount of Jupyter, Python code.

398
00:30:10,030 --> 00:30:15,550
You can get to it, you can play with it, understand how it works, and you're going to recover an ASP.

399
00:30:15,550 --> 00:30:17,170
And then you'll be super happy.

400
00:30:17,250 --> 00:30:24,730
You'll have this super intense satisfaction that you're going to work not necessarily on everything, but it's going to start to make sense.

401
00:30:25,350 --> 00:30:31,990
As I said, it's for everyone who is interested in pen testing, one way or another, or have fun.

402
00:30:32,450 --> 00:30:36,270
You want to break into a lock.

403
00:30:36,790 --> 00:30:38,490
Maybe there's a timing attack.

404
00:30:38,670 --> 00:30:49,310
There was some petitions that some of the super high security locks, the Kaban one where you have rotation and things, might have a timing attack.

405
00:30:49,710 --> 00:30:51,930
There are secretaries that may be there.

406
00:30:52,470 --> 00:30:57,130
For me, it's for everyone.

407
00:30:58,750 --> 00:31:03,250
I love that you went to radio first and then math and crypts came later.

408
00:31:03,530 --> 00:31:04,810
That's good, right?

409
00:31:05,950 --> 00:31:09,470
It's not a deep mathematical background, to be clear.

410
00:31:09,470 --> 00:31:11,930
It's literally observing a signal.

411
00:31:12,050 --> 00:31:14,810
If I do A, the signal looks like this.

412
00:31:14,810 --> 00:31:16,530
If I do B, the signal looks like this.

413
00:31:16,530 --> 00:31:20,230
If I can see differences, then I can construct something.

414
00:31:20,410 --> 00:31:24,450
Of course, you can do more and more complicated stuff to do more hypotheses.

415
00:31:24,610 --> 00:31:28,150
That becomes complicated at some point.

416
00:31:28,570 --> 00:31:32,190
The basic stuff is really like, I look at something.

417
00:31:32,190 --> 00:31:35,590
It's a very experimental, very hacking thing.

418
00:31:35,590 --> 00:31:37,270
It's for doers.

419
00:31:37,270 --> 00:31:40,770
For people who like to tinker with stuff.

420
00:31:40,850 --> 00:31:43,850
Basically, if you're here, you're on the chat, you are the right person.

421
00:31:43,850 --> 00:31:44,430
Let's put it that way.

422
00:31:44,430 --> 00:31:49,750
If you are a DevCon person, you are the right audience for the citation attack, because it's all about doing.

423
00:31:51,030 --> 00:31:56,010
Math is here to help you and maybe to push it further, but that's not the core of it.

424
00:31:56,010 --> 00:32:00,050
The core of it is... matter.

425
00:32:00,110 --> 00:32:00,710
Things.

426
00:32:00,710 --> 00:32:05,270
The world is made of stuff which does not behave the way people want.

427
00:32:05,570 --> 00:32:08,390
It has a secret, hidden property you'd like to uncover.

428
00:32:08,390 --> 00:32:10,110
That's what citation attack is.

429
00:32:10,150 --> 00:32:13,010
I hope I said it and I get you excited to try it.

430
00:32:13,010 --> 00:32:13,850
I hope so.

431
00:32:15,670 --> 00:32:17,130
We're at the top of the hour.

432
00:32:17,690 --> 00:32:21,930
We appreciate the generosity with your time in answering these questions.

433
00:32:23,070 --> 00:32:27,530
Pretty excited to look at the follow-on work coming out of this.

434
00:32:28,110 --> 00:32:29,670
Thank you for everything you've done.

435
00:32:29,970 --> 00:32:31,690
We'll see you next year, right?

436
00:32:31,690 --> 00:32:33,510
Yeah, I hope so.

437
00:32:33,530 --> 00:32:34,250
Next year.

438
00:32:34,250 --> 00:32:37,830
I hope actually next year is this year's talk.

439
00:32:37,910 --> 00:32:39,530
I'm not going to tell you what it is.

440
00:32:39,530 --> 00:32:40,490
It's a surprise.

441
00:32:40,710 --> 00:32:43,910
As I said, I'll post on Twitter when the GitHub is up.

442
00:32:44,310 --> 00:32:47,110
I'm at Eli on Twitter.

443
00:32:47,490 --> 00:32:50,710
The slides are online as well.

444
00:32:52,330 --> 00:32:54,050
I'll post it on the chat.

445
00:32:54,250 --> 00:32:55,470
I can't post a link, right?

446
00:32:55,470 --> 00:32:56,490
I'm not going to get that.

447
00:32:57,650 --> 00:32:59,470
You can, and I just did.

448
00:32:59,810 --> 00:33:04,350
I promise I'll post as early as I can.

449
00:33:05,090 --> 00:33:07,150
Thank you so much for watching the talk.

450
00:33:07,470 --> 00:33:09,310
Hopefully next year we're all in person.

451
00:33:10,070 --> 00:33:13,710
As usual, I'm always happy to answer any questions.

452
00:33:14,170 --> 00:33:19,190
Just hit me with a DM or on Discord or whatever you guys want, and I'll try to do my best to answer questions.

453
00:33:19,630 --> 00:33:20,330
Thank you so much, Eli.

454
00:33:20,330 --> 00:33:21,950
I hope you have a nice DEF CON.

455
00:33:21,950 --> 00:33:24,330
There's always a cool talk to watch.

456
00:33:24,330 --> 00:33:26,630
I'm super excited to watch a few more.

457
00:33:27,410 --> 00:33:28,390
Thank you so much.