论文标题
déjàvu：Mozilla的NSS的侧通道分析
Déjà Vu: Side-Channel Analysis of Mozilla's NSS
论文作者
论文摘要
侧道渠道分析（SCA）的最新工作针对的是旧的，众所周知的漏洞，甚至在备受瞩目的密码库中进行了剥削，报告和修补。然而，研究人员继续在新产品和新产品中找到并利用相同的漏洞，重点介绍了供应商之间的一个大问题：当未直接对其进行披露时，有效地跟踪和修复安全漏洞。在这项工作中，我们通过对Mozilla的NSS安全库进行第一个范围的SCA安全评估来介绍此问题的另一个实例。我们使用两个独立开发的SCA安全框架的组合来识别和测试安全漏洞。我们的评估发现了影响DSA，ECDA和RSA密码系统的NSS中的几个新漏洞。我们利用了漏洞并使用信号实施关键恢复攻击 - - 通过定时，微体系结构和EM-以及改进的晶格方法提取的不同技术提取。
Recent work on Side Channel Analysis (SCA) targets old, well-known vulnerabilities, even previously exploited, reported, and patched in high-profile cryptography libraries. Nevertheless, researchers continue to find and exploit the same vulnerabilities in old and new products, highlighting a big issue among vendors: effectively tracking and fixing security vulnerabilities when disclosure is not done directly to them. In this work, we present another instance of this issue by performing the first library-wide SCA security evaluation of Mozilla's NSS security library. We use a combination of two independently-developed SCA security frameworks to identify and test security vulnerabilities. Our evaluation uncovers several new vulnerabilities in NSS affecting DSA, ECDSA, and RSA cryptosystems. We exploit said vulnerabilities and implement key recovery attacks using signals---extracted through different techniques such as timing, microarchitecture, and EM---and improved lattice methods.
