WEBVTT 00:08.320 --> 00:12.960 Are you seeing us, sir? 00:17.620 --> 00:19.880 Okay, we're good. 00:20.620 --> 00:28.960 Alright guys, we have Ellie Burstyn here to talk to us today about Hacker's Guide to Side Channels. 00:29.060 --> 00:36.000 And with that, I'd like to turn it over to you to have any sort of first questions, or first answers. 00:36.000 --> 00:39.120 And we'll start taking questions on the Discord channel. 00:39.120 --> 00:41.320 So, thank you for joining us. 00:41.420 --> 00:44.420 And any sort of open remarks or anything? 00:46.920 --> 00:48.800 Thank you for watching the talk. 00:49.220 --> 00:51.380 I would have loved to do it in person. 00:51.380 --> 00:58.740 I kind of miss the DevCon ambience, but I hope we'll try to have a good chat, ask anything you want, and try to do my best. 00:59.320 --> 01:01.620 And again, thank you so much for watching the talk. 01:03.740 --> 01:06.140 So, I guess I'll start off. 01:06.140 --> 01:23.300 I think you did a good job in the talk, talking about the sort of why of machine learning, and why the model predicted... or why machine learning decided the way it decided, if that makes sense. 01:23.300 --> 01:30.020 And why the model predicted what it predicted in order to understand how a defender would react to that. 01:30.020 --> 01:32.680 I don't know if you want to elaborate on that talk. 01:32.680 --> 01:33.540 I've never sort of... 01:33.540 --> 01:37.340 I've never thought of machine learning... 01:37.340 --> 01:46.960 you think of machine learning, judging it on what the outcome of it is, not what led to that outcome, and what defense to build from it. 01:46.960 --> 01:53.360 So, I don't know if you want to comment on that thought, or if it even makes sense, what I just asked. 01:53.420 --> 01:54.320 No, it does. 01:54.320 --> 01:54.680 It does. 01:54.680 --> 01:55.280 It does. 01:56.700 --> 02:01.100 I think we have a lot of security tools for debugging. 02:01.100 --> 02:05.280 I think if you want to debug a C++ program, we have debugger. 02:05.740 --> 02:09.120 We have Python debugger, C++ debugger. 02:09.980 --> 02:17.180 Most of the things we can debug, because we have a way to introspect where the bug is triggered. 02:17.180 --> 02:23.220 The systems, the entire stack is developed around error handling. 02:23.440 --> 02:25.540 The problem is how the crypto is. 02:25.540 --> 02:34.020 You run a crypto algorithm on the hardware, and you have no idea why information is taken. 02:34.060 --> 02:34.920 You have a leak. 02:34.920 --> 02:40.680 You know that the machine learning is finding the correct key, or the correct attack point. 02:40.940 --> 02:49.540 And you're like, OK, I developed this kind of implementation, and we do at Google have our own cryptographic chip, so that's something we're very concerned about. 02:49.540 --> 02:54.880 And everyone who has a crypto chip is interested in that question of, OK, you have a leak, but then what? 02:55.300 --> 03:03.620 And prior to machine learning, we didn't have a technique, or we didn't have a tool, where you can ask, why? 03:03.620 --> 03:05.020 Why do you predict what you do? 03:05.300 --> 03:08.280 This is kind of like a crazy thing about the machine learning thing. 03:08.280 --> 03:11.760 It does things which we can't do otherwise. 03:11.760 --> 03:14.960 It's not ideal, because, you know, we all say, well, machine learning is a black box. 03:14.960 --> 03:16.380 That's completely true. 03:16.640 --> 03:21.700 But the only thing we have, which is like, OK, can you please tell me why? 03:22.200 --> 03:26.300 The why is a little bit easy, but it's like, why? 03:26.340 --> 03:35.800 And then we thought, OK, since we moved from site-generator using statistical estimates to machine learning, and we talked about it last year at DEF CON, it works really well. 03:36.000 --> 03:38.820 Can we go one step further and try to also ask the model why? 03:38.820 --> 03:40.480 And then you can do that. 03:40.480 --> 03:43.160 And as I said, it's very, very brittle. 03:43.760 --> 03:48.000 You have to be super, super precise, and we make it work for one implementation. 03:48.220 --> 03:50.880 And, you know, it's a tool, so obviously we're going to show you the best case. 03:50.880 --> 04:00.580 The truth of the matter is, you know, you have to really be super precise, which is like CPU instruction precise, so it's not super robust just yet, but you can do that. 04:00.580 --> 04:02.840 And I think that's the only tool in the world who can do that. 04:02.840 --> 04:05.220 That's why Scaled is one of its kind. 04:05.220 --> 04:07.140 It's the first generation of it. 04:07.340 --> 04:12.440 You know, five years, ten years from now, we'll be laughing at it and be like, OK, we've got a way to do it, I'm pretty sure. 04:12.760 --> 04:22.860 But it was two crazy years of brainstorming and trying ideas until we came up with an idea of doing it. 04:22.860 --> 04:24.480 It came out of necessity. 04:24.480 --> 04:34.940 It came out from our project team inside Google of like, OK guys, you make better attacks, which was not the goal, but the goal of our whole project was to make a better world, like a more secure world. 04:35.100 --> 04:47.520 I didn't have to pitch a choir, and then we really wanted to make a tool for our engineering team of like, and around the world of like, OK, here's a tool you can use, here's a tool lab, here's a debugger for hardware crypto. 04:47.520 --> 04:49.120 And it just doesn't exist. 04:49.120 --> 04:51.600 So that's where it comes from. 04:51.640 --> 04:55.980 And without machine learning, it doesn't work, but without the relations, it doesn't work, and without the community, it doesn't work. 04:55.980 --> 04:59.620 We use a lot of the technology behind the scenes, like Unicorn. 04:59.760 --> 05:02.180 And we had a pretty good talk today about Unicorn as well. 05:02.180 --> 05:11.920 A lot of people are using Unicorn, which is a CPU emulator, which is very close to the community, so we are standing on shoulder of giants, which is bringing some of the interesting twists to it. 05:13.040 --> 05:14.160 That's what it is. 05:15.520 --> 05:16.240 Great. 05:16.240 --> 05:27.640 So actually, just jumping off what you said, are people actually using this to help identify side channels yet, or have you been approached by anyone? 05:27.640 --> 05:28.660 No, not yet. 05:30.800 --> 05:40.480 To be clear, we had a lot of debate actually internally, because it's really super out of the press. 05:40.480 --> 05:46.180 I would say the initial complete success was probably one or two weeks old. 05:46.180 --> 05:51.260 We knew it was somewhat working, but we didn't get it to work as clearly as it should. 05:51.260 --> 05:55.480 It took like, I think maybe 24 hours before I recorded the talk to be clear. 05:56.540 --> 06:02.800 But we saw that DevCon is virtual, we really want to contribute, we really want to be part of the community. 06:03.640 --> 06:18.520 Usually we're not really good at things ahead of what we do, but this year we saw that we wanted to really show you the trading engine, what we were working on as a way to participate and to be part of the community. 06:18.620 --> 06:21.040 So , no, it's not there yet. 06:21.040 --> 06:22.720 The research effort is not there yet. 06:22.760 --> 06:25.240 I'm sure the COVID question is going to come, so I'll answer. 06:25.340 --> 06:27.120 Yes, the code will be public next week. 06:27.120 --> 06:30.980 I'm still cleaning up the GitHub to tell you how new it is. 06:31.300 --> 06:34.900 But we went for, here is something new and exciting that we work on. 06:34.900 --> 06:39.840 You guys might get a kick out of looking at it and be inspired, and that's what we go for. 06:40.200 --> 06:42.480 So, the talk, sometime I'm bumping into the middle of it. 06:42.700 --> 06:43.840 Sorry about that, too. 06:43.960 --> 06:45.840 I tried to record it with the door closed. 06:45.840 --> 06:50.980 In California, it's like 28 degrees in the room when I try to record, so I was straining a little bit. 06:50.980 --> 06:52.600 I apologize also for my English. 06:53.180 --> 06:59.540 But, yeah, we really tried to do like, this is the state mode talk, which is like, we do show you bleeding edge. 06:59.540 --> 07:02.260 Like, it's a true, you know, very old DevCon spirit. 07:02.260 --> 07:04.640 Like, this is new, we're here to transform it. 07:04.640 --> 07:05.500 That's what it was. 07:05.500 --> 07:06.320 So, no, it's not here. 07:06.320 --> 07:07.880 Absolutely not. 07:12.300 --> 07:14.100 That's great. 07:14.740 --> 07:23.360 So, the example we're using were mostly around power, if I understood the presentation right. 07:23.360 --> 07:30.460 And, you know, you mentioned other side channels, you know, heat, emissions, timing, etc. 07:30.460 --> 07:39.060 I mean, do you see these techniques would apply to all those, or there wasn't anything unique to the instrumentation you used, right? 07:39.620 --> 07:43.160 No, I don't see there's anything special to it. 07:43.480 --> 07:47.660 I never used, I said, I don't know if anyone ever used heat. 07:47.660 --> 07:54.140 I would be super curious if someone knows about a heat attack, timing attack, which is super, super interesting. 07:54.140 --> 07:55.340 I've never seen one. 07:55.720 --> 07:58.900 Like, in crypto, they might exist, I don't know. 07:58.900 --> 08:04.540 But we thought about, yeah, magnetic, I think, is one of the big deal. 08:07.580 --> 08:10.140 We wanted to do this here, to be clear. 08:10.600 --> 08:13.500 And extend what we do from power to EM as well. 08:13.880 --> 08:23.140 The truth of the matter is, we cannot go to the office, right, doing remote work in our team, as many of us are doing in the community, and we don't have access to our equipment, right. 08:23.140 --> 08:27.120 The only thing we can really do is power, because that's what is plugged into our lab. 08:27.320 --> 08:30.660 And the only thing we can access remotely to do is EM. 08:30.660 --> 08:34.220 You have to literally have an EM table, and you have to be on top of the chip. 08:34.460 --> 08:37.320 And that is not doable in the near future. 08:37.320 --> 08:38.840 So, we'd love to do EM. 08:39.580 --> 08:42.520 I think the next big target is that. 08:42.680 --> 08:45.640 You would do, maybe timing. 08:45.640 --> 08:47.240 Timing might work too, probably. 08:47.240 --> 08:57.460 I think there is a few papers coming out this year from other groups on machine learning and timing attacks for Parasite, I believe. 08:57.840 --> 09:01.920 I don't think we'll be able to cure it, so I think it will most likely show that you can use machine learning for that. 09:02.000 --> 09:10.700 So, as I said, machine learning is an easier way to take over such an attack for hardware in the next 2-3 years than when it's going to do it. 09:11.080 --> 09:14.140 We just happened to be the first few groups who are doing it. 09:14.140 --> 09:15.480 There are other groups in France. 09:17.240 --> 09:19.620 There's a German group as well who is doing some of it. 09:19.880 --> 09:23.860 Some vendors are taking some of the research and putting it into products. 09:23.860 --> 09:25.160 I think that's where it's going to go. 09:25.160 --> 09:29.280 But I think most people are on the power train for now. 09:29.300 --> 09:32.440 Maybe a little bit of timing attack is pretty new this year. 09:32.720 --> 09:34.400 I guess the end is the next. 09:34.480 --> 09:39.340 Yeah, I was wondering that too. 09:39.340 --> 09:43.760 It's kind of, as you were saying, you built your model, I guess, using mostly an emulator. 09:44.040 --> 09:47.680 How well does that scale then to other hardware? 09:47.700 --> 09:50.820 Is it kind of the research you've done, it's that one sample? 09:50.820 --> 09:56.180 Or do you think that you're going to need to build your machine learning models for different types of processors or setups, right? 09:56.180 --> 09:57.140 Does that make sense? 09:57.400 --> 10:01.120 Yeah, so for the attack side, we know it works. 10:01.420 --> 10:06.900 I mean, I hope it's not a unique paper, but since last year we've been working. 10:06.900 --> 10:13.420 The last three years we have collected a massive set of data sets that we really hope to publish. 10:13.420 --> 10:15.100 I'm not going to give a date at that point. 10:15.100 --> 10:17.580 Last year I said very soon, and it didn't happen this year. 10:17.800 --> 10:19.320 Or the next year we have. 10:19.320 --> 10:23.560 But yes, we have that for multiple data sets, multiple hardware that works. 10:23.640 --> 10:32.660 For the emulation side, the other side, which is not the machine learning side, the dynamic analysis where we need to be site-precise, we don't even have a normal. 10:32.660 --> 10:47.760 And the thing is, Intel is, for example, out of the question because they have a predictive pipeline, so we don't even know, like, depending on how the Intel predictive pipeline will work or the flush pipeline will work, the number of instructions is completely non-deterministic. 10:47.760 --> 10:51.200 Or at least to the point where, in our poor brain, we're not going to be able to do it just yet. 10:51.420 --> 10:54.460 So if your CPU is too complicated, I don't think we can. 10:55.420 --> 11:05.480 Reduce set instructions should work, I guess, but like I said, we don't even have a device now because it's like, oh, it's between, I don't know what the range is, 2 to 12 cycles. 11:05.480 --> 11:08.700 So we have to make an estimated guess. 11:08.700 --> 11:12.520 So it works for ARM, mostly embedded stuff, I assume. 11:12.520 --> 11:14.720 Smaller power would work too. 11:15.300 --> 11:31.620 But yes, the emulation side of it is hard because if you're off, you know, if your machine learning is correct, it finds the attack, then if you're off for the cycle for the emulation, you end up, I don't know, like, 6, 12, 15, 100 cycles left or right, 11:31.620 --> 11:33.940 and then you're on the wrong line of code, right? 11:33.940 --> 11:43.740 The line of code that I said is true for instructions, so you might have, you know, you might get lucky if you're a little bit slowly, but that margin becomes terrifyingly hard. 11:43.740 --> 11:52.180 And similarly, there is a back point at the end of the... you can also apply the end of the implementation, not the first round, but the end. 11:52.180 --> 11:56.360 And then, again, at that point, every error is compounded, right? 11:56.360 --> 12:03.580 So the further you undertrace on the right side of this, the more you're going to have a chance of mixing it up. 12:03.800 --> 12:16.360 So yes, we choose easy case, which is like very well-defined ARM, which is a very small set of instructions, well-defined, well-documented, on an easy C non-vectorized, because that's the easy case. 12:17.260 --> 12:20.640 Harder case would be like more features of engineering. 12:20.640 --> 12:26.920 I think the people in the committee are interested to help us improve the analyzer or add more targets. 12:26.920 --> 12:32.080 It's probably doable, it's just going to be interesting reversing engineering exercise, right? 12:32.400 --> 12:33.900 And that's what people put at hardware. 12:33.900 --> 12:37.220 It's fun to do, it's just, it's going to be quite worse. 12:38.640 --> 12:40.140 It's a really good question. 12:41.820 --> 12:51.160 Yeah, so, I mean, the attacks themselves are pretty hard, so it goes to show that the defensive analysis would be just as hard, right? 12:54.160 --> 13:03.480 Yeah, I mean, we know that hardware, I mean, we know that stationary attacks are inevitable, right? 13:03.480 --> 13:04.640 Almost inevitable. 13:04.640 --> 13:12.780 There are defenses which might exist, like doubling the bus for power supply, power attack, but that's not going to be implemented in hardware. 13:12.780 --> 13:16.360 It's too expensive or too costly or too big. 13:16.720 --> 13:20.360 So, everything is inevitable to size your attack to an extent. 13:20.640 --> 13:23.720 The question is, how can we make it right? 13:23.720 --> 13:34.620 There are really cool set of work done mostly by the French ANSI on MASSKS which is kind of like the way you make it harder. 13:34.780 --> 13:36.580 You can also make it slower. 13:37.260 --> 13:42.160 So, the question is, how slow can be hardware encryption, right? 13:42.160 --> 13:44.740 The question is, how many milliseconds can you tolerate? 13:45.100 --> 13:51.560 The reason why I mention that is, if you use security keys, right, we create security keys, they use NFC. 13:51.560 --> 13:54.620 And the problem with NFC, NFC is super fast and super low power. 13:54.620 --> 13:59.680 So, now, in those settings, making a super resilient implementation is going to be challenging. 13:59.920 --> 14:05.840 So, being said, this is not AES as we show, but even for that you cannot switch out. 14:06.000 --> 14:08.860 If you want APK, also you cannot switch out. 14:10.180 --> 14:12.280 Well, I don't have a lot of time. 14:12.520 --> 14:13.860 I don't have a lot of power. 14:14.600 --> 14:19.060 And with more computation to harden my thing, that becomes kind of impossible. 14:19.060 --> 14:20.700 So, there will always be a trade-off, right? 14:20.700 --> 14:23.640 And as long as there is a trade-off, there is a vulnerability. 14:23.960 --> 14:33.840 So , you know, Tyler's channel attack is probably the most powerful attack you can do against cryptos these days because this is the one where we know we cannot solve it. 14:33.840 --> 14:35.380 So, interesting. 14:35.380 --> 14:37.600 It's an interesting space. 14:37.840 --> 14:43.100 Pretty interesting. 14:43.400 --> 14:47.600 Yeah, and I'll say, I really appreciated your talk, too, how you went through the different steps. 14:47.600 --> 14:50.120 It was very informative and instructive. 14:50.180 --> 14:56.860 Like, even just mentioning explainers, you did a very good job of explaining everything and really showing the real world examples. 14:57.140 --> 15:00.540 You say, though, you say side-channel attacks are really important for encryption. 15:00.540 --> 15:03.080 How did you get into the side-channel attack space? 15:03.080 --> 15:04.080 What drew you to that? 15:04.080 --> 15:05.620 Was it the encryption aspect? 15:05.620 --> 15:09.640 How did your research end up on side-channel attacks? 15:10.700 --> 15:12.080 Oh, wow. 15:14.850 --> 15:16.410 That's a hard question. 15:16.850 --> 15:25.950 I think what happened is before, I always did cryptanalysis. 15:27.390 --> 15:35.010 People might or might not remember it, but a few years back, we announced the first collision on SHA-1. 15:35.750 --> 15:39.550 And we did it all at that time. 15:41.230 --> 15:43.110 And it took us a while. 15:43.110 --> 15:44.630 It took us a while to do it. 15:44.630 --> 15:49.230 Breaking SHA-1 in collaboration with Mark Stevens, the CWI, took three years. 15:49.610 --> 15:52.910 Most people don't realize that sometimes when we do talk, it's like, oh, that's great. 15:52.910 --> 15:53.550 That's nice. 15:53.550 --> 15:58.250 It took three years of effort for us, and I think Mark spent almost ten years on it. 15:58.250 --> 16:12.970 So you get out of breaking SHA-1 I mean, putting it in practice, it was broken by one, but like providing the first collision, and then, as I said, in 2015 we did the first collision. 16:12.970 --> 16:18.750 We showed these two PDFs which are about to send SHA-1, and then the world did break SHA-1, which was our goal. 16:19.530 --> 16:36.890 Interestingly enough, the backstory, the reason why we decided to do it is not to do a talk, but because we really wanted to help people realize that they need to move away from it at the time Microsoft, XCOR, did not deprecate it and Firefox was lagging, 16:36.890 --> 16:51.390 and it had the immediate effect that both of them immediately deprecated it, so it was like why would you ever go into this crazy amount of money and amount of energy to literally compute all this? 16:51.390 --> 17:01.890 And the answer was because, at that time, we wanted to show to the world, it was with both Microsoft and XCOR, and we should treat it seriously. 17:01.890 --> 17:14.170 Again, it was important to get this always in the context of our team, the research team, we tried to set up an XOR where people come up to this project and try to figure out if it can help the world. 17:14.270 --> 17:19.670 And then we finished that, and we were like, okay what else? 17:19.930 --> 17:27.910 And then, so yeah, our first research team is almost a hangover because we had to get professional marketing and we were like, what's next? 17:28.250 --> 17:31.330 A piece of crypto, and then we were like, okay what's next? 17:32.010 --> 17:41.930 And then we started to talk with the project team, and at that time something called the Titan chip, publicly, is developed by Google. 17:41.930 --> 17:43.630 It's Google's own crypto chip. 17:43.630 --> 17:48.150 And the crypto chip we talked to the hardware engineer, and they told us, well, no. 17:48.690 --> 17:58.450 So this crazy idea, we come up with one paper from the French agency, which is the French control agency specializing in crypto. 17:58.830 --> 18:03.150 They have this very, very interesting work on machine learning and crypto, you should check it out. 18:03.530 --> 18:05.670 And I was totally in love with the idea. 18:06.110 --> 18:13.490 The internal team was very interested in having more resources, and then we realized it's very, very powerful, very interesting. 18:13.490 --> 18:18.490 It's played well into what Google do, which is machine learning at the time, it's here. 18:19.170 --> 18:23.870 It plays well into core and fundamental research that we do. 18:23.970 --> 18:26.810 It plays well with... that's what we decided to go for. 18:26.870 --> 18:40.690 Honestly, we got from our project team, so it was completely serendipitous, and has been seen in research more like you know, talking to people, and it's like something like that. 18:40.690 --> 18:48.610 You want to talk, you get inspired by other people, you build on other people's work or ideas, and we all keep it to push it further. 18:48.910 --> 18:50.710 So I think that's what it was. 18:51.070 --> 18:56.370 I think that was this idea of come from other people, and take credit for it all. 18:56.390 --> 19:13.070 We met a lot of wonderful people from Ledger, from Chipwister, you know, Colleen, and many Chipwisters by the way, the scaffolding committee, the institutional community, we also have a lot of time to help us, give us pointers early days. 19:13.070 --> 19:17.070 So we're glad that now we're back. 19:18.470 --> 19:20.710 Great, so we have a question from the audience. 19:20.790 --> 19:27.430 Apart from approving the emulation, what do you see as the next step in this field of side-channel detection? 19:30.970 --> 19:31.490 Detection... 19:34.470 --> 19:36.230 That's a great question. 19:37.950 --> 19:39.870 I think there are ... 19:43.230 --> 19:48.530 I think it goes hand-to-hand with better attack. 19:48.670 --> 19:51.270 Again, we can only explain what we can attack. 19:51.270 --> 19:58.870 I think we have a few working streams on public key, and a few working streams on other algorithms. 19:58.870 --> 20:01.130 I think that will be interesting to do. 20:01.370 --> 20:07.370 We're always looking for people who are willing to work with us, because it's a very, very big... 20:08.950 --> 20:15.710 I won't say difficult, but it's a lot of grind to create the data, and to do the machine learning, and that sort of thing. 20:15.710 --> 20:22.330 So if people are interested to collaborate, we're always up for it, because it's a little bit like, figure out what to do, it's hard. 20:22.490 --> 20:25.410 Last year, when I come, I go, it's so hard to do the IAF model. 20:25.410 --> 20:31.190 This year, after a year of refining the machine learning model and our process, we can basically do it in 10 minutes. 20:31.190 --> 20:38.230 So we went from 5 hours to 15 minutes by getting just mechanically better at it. 20:38.230 --> 20:41.210 I think it's going to be the same for the other algorithms. 20:41.490 --> 20:43.630 So I really view that. 20:43.630 --> 20:47.950 I think we're also going to view, I hope, people being creative for it. 20:49.090 --> 20:50.290 I don't know. 20:50.630 --> 20:53.270 I would imagine you can do that timing attack. 20:53.270 --> 20:55.830 Some people mentioned cache line as an idea. 20:55.830 --> 20:57.450 I found that quite interesting. 20:57.670 --> 21:02.030 There is a holy grail of Intel HDX. 21:02.030 --> 21:04.790 I mean, Enclave is also using crypto. 21:05.570 --> 21:10.330 It is crazy hard to attack, because it's literally baked into the Intel CPU. 21:10.850 --> 21:13.990 However, no one knows if machine learning can do it or not. 21:13.990 --> 21:16.550 Some people we talked to say yes, it's probably doable. 21:16.830 --> 21:17.430 I don't know. 21:17.430 --> 21:18.590 I never do it. 21:18.910 --> 21:21.630 We don't have necessarily the time to do it by ourselves. 21:21.630 --> 21:25.010 We're happy to contribute, but that's something which is interesting line of research. 21:25.010 --> 21:26.990 I think Enclave is a big deal. 21:27.990 --> 21:29.730 Other algorithms are a big deal. 21:29.730 --> 21:31.610 But also we can think of crazy things. 21:31.610 --> 21:33.590 Everything which is timing sounds a bit bad. 21:34.370 --> 21:45.490 I would not be surprised if someone even came up with a crazy idea of how to do it for Bitcoin wallet transactions, or even what would be another interesting step. 21:45.490 --> 21:46.430 SQL injection. 21:46.530 --> 21:48.190 We have a lot of blind SQL injection. 21:48.690 --> 21:51.770 Maybe we can get more out of the timing. 21:51.770 --> 21:54.390 We can make more out of the timing that we think we can. 21:55.570 --> 21:56.510 It's unclear. 21:56.550 --> 22:00.890 I mean, most of them should have been fixed, but yeah, I don't know. 22:00.890 --> 22:03.970 That's a lot of room, a lot of creativity. 22:04.550 --> 22:06.090 It depends on people's taste. 22:07.350 --> 22:08.310 I'm not sure. 22:09.590 --> 22:11.990 So you mentioned a paper is coming out. 22:12.030 --> 22:15.150 Do you have an estimate on when you're going to be done with that? 22:15.810 --> 22:17.650 I'm not going to jinx it, Matt. 22:17.650 --> 22:18.970 I'm not going to do that. 22:18.970 --> 22:20.910 Last year I said it's going to be soon. 22:21.190 --> 22:23.030 The draft is still on my desk. 22:23.030 --> 22:26.710 And for the schedule paper, I'm going to be completely honest. 22:26.710 --> 22:28.630 I told you we rushed to do it for DEF CON. 22:28.630 --> 22:30.270 We really wanted to show you Building Edge. 22:31.070 --> 22:32.750 Literally the paper is not ready yet. 22:32.750 --> 22:35.870 The next step for us is to put everything on GitHub. 22:36.570 --> 22:39.690 I'll post the link on Twitter hopefully next week. 22:41.510 --> 22:44.510 And then we're going to want people to play with it. 22:44.630 --> 22:50.210 We'd rather provide incomplete stuff to people to play, because last year we did the reverse. 22:50.210 --> 22:54.610 We thought we were going to hold, hold, hold, and get everything at once and it didn't work out. 22:54.610 --> 22:56.970 So this year, we're switching the strategy. 22:57.370 --> 22:58.790 I'm going to release early. 22:59.390 --> 23:00.330 Imperfect, but early. 23:00.330 --> 23:02.010 And then the paper will come later. 23:03.210 --> 23:04.010 Completely what? 23:04.010 --> 23:07.530 But yes, the AES datasets we promised last year are still there. 23:07.530 --> 23:11.090 We just haven't got the chance to release them. 23:11.090 --> 23:14.110 And then the schedule paper, you'll be able to play with the code. 23:14.130 --> 23:15.410 Run the code I showed you. 23:15.410 --> 23:16.750 Get the verb I showed you. 23:16.750 --> 23:22.150 And then that will be incomplete, because you'll be like, oh, where are the other attack points? 23:22.150 --> 23:23.070 Not there yet. 23:23.070 --> 23:24.050 Where are the other models? 23:24.050 --> 23:24.770 Not there yet. 23:24.770 --> 23:27.390 They're going to get there when they can. 23:27.390 --> 23:28.690 And I make no promises. 23:29.430 --> 23:32.110 Because I can't I don't know what I can keep or not. 23:32.110 --> 23:36.130 So I try to be a little bit more realistic this year than last year. 23:36.270 --> 23:38.770 I want to achieve good people. 23:39.050 --> 23:42.270 I was going to ask the same thing, so it's definitely on folks' minds. 23:42.390 --> 23:44.130 We do have a question from the chat. 23:44.370 --> 23:50.610 So, you know, are you aware of any side-channel attacks that are found in the wild, right, where attackers are using them? 23:50.610 --> 23:56.330 Or is this more of where we're thinking about how to defend against these attacks before, you know, we see them active? 23:56.750 --> 23:59.750 Oh, side-channel are everywhere. 24:00.230 --> 24:01.490 Side-channel are everywhere. 24:01.490 --> 24:04.550 They're like the most prevalent form of attack for hardware. 24:05.610 --> 24:09.450 Let me try to figure out which one I can tell you which are pretty interesting. 24:09.550 --> 24:11.170 So again, it's not singular. 24:11.230 --> 24:16.530 To put one company like this company is bad, because I'm going to use all of them. 24:16.690 --> 24:21.790 So I start with one of my favorite companies, which I really like, Ledger. 24:21.950 --> 24:28.070 Two years ago, they had away someone from a timing attack on the IoT curve. 24:28.070 --> 24:30.130 This was the example I gave at the beginning of the talk. 24:30.170 --> 24:36.070 And they were able to recover all the Ledger treasure by Bitcoin private key. 24:36.070 --> 24:37.730 So that's a pretty big deal. 24:38.990 --> 24:41.910 There was a timing attack on a game console. 24:42.350 --> 24:44.210 I think it was streaming on Twitch. 24:44.210 --> 24:53.850 I'm not going to give too much detail, but many, many game consoles are protected by crypto. 24:54.370 --> 24:57.650 And there was a timing attack to recover some of those secret keys. 24:57.990 --> 24:59.950 That was earlier generation. 24:59.950 --> 25:06.350 I'm not talking 5 or 4 or Xbox One. 25:06.350 --> 25:12.750 I'm talking previous generation, but there was a timing attack who were used to recover crypto keys. 25:12.750 --> 25:14.250 There was many of them. 25:14.250 --> 25:24.170 There was an AES one a very long time ago used by... I believe it was Dan Bernstein on remote AES. 25:24.170 --> 25:29.050 There was one on cache line attacks on CPUs. 25:29.050 --> 25:31.070 There are so many of them everywhere. 25:31.310 --> 25:33.970 Session attacks are so powerful. 25:33.990 --> 25:38.290 The most powerful form of SQL injection is binary SQL injection. 25:38.710 --> 25:40.150 Sorry, session attack. 25:40.150 --> 25:46.010 Binary SQL injection is when you have a SQL injection, but you can't see the output when you trigger. 25:46.330 --> 25:51.050 You do it one character at a time and you just look at whether the server responds or not. 25:51.050 --> 25:52.690 That's a form of session attack. 25:52.910 --> 25:54.070 They are everywhere. 25:54.270 --> 26:00.850 It's a super, super practical attack and usually people are really annoyed and say it's not a good attack because it's a known technique. 26:00.850 --> 26:02.010 It's not a known technique. 26:02.010 --> 26:02.810 It's a known technique. 26:02.810 --> 26:08.770 It just happens that it works super, super efficiently on many, many things. 26:09.770 --> 26:10.970 Yep. 26:12.550 --> 26:20.830 And we have it on physical stuff like electronic locks and things like that. 26:26.150 --> 26:27.830 Oh, I forgot. 26:27.930 --> 26:31.750 I thought that was the most important one. 26:31.750 --> 26:32.810 I'm sorry. 26:33.630 --> 26:35.430 Spectre and Meltdown. 26:36.030 --> 26:37.030 Right. 26:37.030 --> 26:37.690 Spectre and Meltdown. 26:37.690 --> 26:38.630 There you go. 26:38.770 --> 26:40.750 The thing which completely destroys your CPU. 26:40.750 --> 26:43.270 They are a form of session attack. 26:43.270 --> 26:44.010 So here you go. 26:44.190 --> 26:55.770 As I said, some of the most powerful concrete attacks we've seen in the last few years are session attacks because they are so hard to debug, so hard to pull off, to defend against. 26:55.770 --> 26:59.690 Yeah, I think I read something about those. 27:00.390 --> 27:02.150 They were kind of big, right? 27:02.590 --> 27:07.230 Yeah, I pinned in the chat the article. 27:07.230 --> 27:10.030 There's a weird article who can outline that. 27:10.030 --> 27:13.610 It would be good to just read up if you guys are interested. 27:16.030 --> 27:17.310 I think it's QA. 27:17.310 --> 27:17.750 There you go. 27:17.750 --> 27:18.410 Thank you. 27:18.870 --> 27:19.490 Yep. 27:20.550 --> 27:22.450 Yeah, so we've got a couple minutes left. 27:22.450 --> 27:25.430 If we have any more questions, let's get them in here. 27:25.710 --> 27:34.630 Otherwise, we're going to thank Ellie and let you guys get back to the con. 27:35.530 --> 27:37.390 One last one for me. 27:38.090 --> 27:40.270 Oh, wait, we actually do have one more. 27:41.530 --> 27:44.110 Yeah, so someone who is mainly focused in InfoSec. 27:44.830 --> 27:55.450 What kind of background do you think people kind of lend themselves to going towards looking at side-channel attacks and thinking about the research you're doing with being able to detect that in different ways? 27:57.270 --> 27:58.690 What kind of background? 28:00.590 --> 28:01.910 It varies. 28:04.510 --> 28:09.930 We have some people who come from radio. 28:11.230 --> 28:25.430 For those who don't know, the first initial side-channel attack was actually in the 1940s or something like that, where they had a typewriter and the guy was having an oscilloscope, and then he sort of blinked on the oscilloscope and realized that there was something. 28:25.650 --> 28:33.330 And then the Russians put a user to spy onto people by looking at vibrations. 28:33.330 --> 28:34.690 So that's super old stuff. 28:34.690 --> 28:35.930 So that's the radio guys. 28:35.930 --> 28:41.570 The radio guys know a lot about all these electromagnetic things and spycraft there. 28:41.570 --> 28:43.370 So a lot of spycraft comes from that. 28:43.450 --> 28:46.430 We have people who do side-channel attacks who come from hardware. 28:46.570 --> 28:53.750 Hardware people who like to build CPUs and look into meldons, vectors, cache lines. 28:53.750 --> 28:56.510 So those guys also do side-channel attacks in a different way. 28:56.570 --> 29:02.290 We have cryptographers, people who are from a crypto background like me, who are more into that. 29:03.050 --> 29:04.670 So it really depends on your use case. 29:04.670 --> 29:10.590 You have people who do web security with side-channel attacks and side-channel attacks means more SQL injection. 29:10.770 --> 29:15.410 So I think everyone can touch it by the band. 29:16.050 --> 29:17.850 It's fairly easy to get into it. 29:17.850 --> 29:20.710 I think there is this apprehension sometimes. 29:21.190 --> 29:25.910 The first time I read a paper about it, I probably didn't get the best paper to read as an intro. 29:25.910 --> 29:27.930 It felt very bizarre to me. 29:27.930 --> 29:30.470 I didn't really understand what they were going for. 29:30.870 --> 29:38.290 I was a little bit like... it took me three to four months to get used to the mindset of it. 29:38.290 --> 29:39.930 I think it's a very powerful mindset. 29:39.930 --> 29:42.270 I think it's a very fun experience to do. 29:43.190 --> 29:59.110 If you are interested in side-channel attacks, specifically on hardware, and you want to start without machine learning, like more simple stuff like SSTC code, CheapWhisper, which is a thing that is very affordable and even you don't need the whole thing, 29:59.110 --> 30:03.230 you can just run out of existing traces, has a super cool tutorial. 30:03.490 --> 30:10.030 I think Corning from CheapWhisper has put a tremendous amount of Jupyter, Python code. 30:10.030 --> 30:15.550 You can get to it, you can play with it, understand how it works, and you're going to recover an ASP. 30:15.550 --> 30:17.170 And then you'll be super happy. 30:17.250 --> 30:24.730 You'll have this super intense satisfaction that you're going to work not necessarily on everything, but it's going to start to make sense. 30:25.350 --> 30:31.990 As I said, it's for everyone who is interested in pen testing, one way or another, or have fun. 30:32.450 --> 30:36.270 You want to break into a lock. 30:36.790 --> 30:38.490 Maybe there's a timing attack. 30:38.670 --> 30:49.310 There was some petitions that some of the super high security locks, the Kaban one where you have rotation and things, might have a timing attack. 30:49.710 --> 30:51.930 There are secretaries that may be there. 30:52.470 --> 30:57.130 For me, it's for everyone. 30:58.750 --> 31:03.250 I love that you went to radio first and then math and crypts came later. 31:03.530 --> 31:04.810 That's good, right? 31:05.950 --> 31:09.470 It's not a deep mathematical background, to be clear. 31:09.470 --> 31:11.930 It's literally observing a signal. 31:12.050 --> 31:14.810 If I do A, the signal looks like this. 31:14.810 --> 31:16.530 If I do B, the signal looks like this. 31:16.530 --> 31:20.230 If I can see differences, then I can construct something. 31:20.410 --> 31:24.450 Of course, you can do more and more complicated stuff to do more hypotheses. 31:24.610 --> 31:28.150 That becomes complicated at some point. 31:28.570 --> 31:32.190 The basic stuff is really like, I look at something. 31:32.190 --> 31:35.590 It's a very experimental, very hacking thing. 31:35.590 --> 31:37.270 It's for doers. 31:37.270 --> 31:40.770 For people who like to tinker with stuff. 31:40.850 --> 31:43.850 Basically, if you're here, you're on the chat, you are the right person. 31:43.850 --> 31:44.430 Let's put it that way. 31:44.430 --> 31:49.750 If you are a DevCon person, you are the right audience for the citation attack, because it's all about doing. 31:51.030 --> 31:56.010 Math is here to help you and maybe to push it further, but that's not the core of it. 31:56.010 --> 32:00.050 The core of it is... matter. 32:00.110 --> 32:00.710 Things. 32:00.710 --> 32:05.270 The world is made of stuff which does not behave the way people want. 32:05.570 --> 32:08.390 It has a secret, hidden property you'd like to uncover. 32:08.390 --> 32:10.110 That's what citation attack is. 32:10.150 --> 32:13.010 I hope I said it and I get you excited to try it. 32:13.010 --> 32:13.850 I hope so. 32:15.670 --> 32:17.130 We're at the top of the hour. 32:17.690 --> 32:21.930 We appreciate the generosity with your time in answering these questions. 32:23.070 --> 32:27.530 Pretty excited to look at the follow-on work coming out of this. 32:28.110 --> 32:29.670 Thank you for everything you've done. 32:29.970 --> 32:31.690 We'll see you next year, right? 32:31.690 --> 32:33.510 Yeah, I hope so. 32:33.530 --> 32:34.250 Next year. 32:34.250 --> 32:37.830 I hope actually next year is this year's talk. 32:37.910 --> 32:39.530 I'm not going to tell you what it is. 32:39.530 --> 32:40.490 It's a surprise. 32:40.710 --> 32:43.910 As I said, I'll post on Twitter when the GitHub is up. 32:44.310 --> 32:47.110 I'm at Eli on Twitter. 32:47.490 --> 32:50.710 The slides are online as well. 32:52.330 --> 32:54.050 I'll post it on the chat. 32:54.250 --> 32:55.470 I can't post a link, right? 32:55.470 --> 32:56.490 I'm not going to get that. 32:57.650 --> 32:59.470 You can, and I just did. 32:59.810 --> 33:04.350 I promise I'll post as early as I can. 33:05.090 --> 33:07.150 Thank you so much for watching the talk. 33:07.470 --> 33:09.310 Hopefully next year we're all in person. 33:10.070 --> 33:13.710 As usual, I'm always happy to answer any questions. 33:14.170 --> 33:19.190 Just hit me with a DM or on Discord or whatever you guys want, and I'll try to do my best to answer questions. 33:19.630 --> 33:20.330 Thank you so much, Eli. 33:20.330 --> 33:21.950 I hope you have a nice DEF CON. 33:21.950 --> 33:24.330 There's always a cool talk to watch. 33:24.330 --> 33:26.630 I'm super excited to watch a few more. 33:27.410 --> 33:28.390 Thank you so much.