SOME DUTCH RESEARCHERS have discovered a way of cracking AES-256 encryption using reasonably cheap gear and wireless tech. <\/p>\n
Fox-IT, which is the Dutch company, calls the attack 'Tempest' and explains that it is enabled through proximity and relies on the monitoring of electromagnetic signals in what is known as a side channel attack. <\/p>\n
Researchers put together a piece of kit worth less than $200 and were able to wirelessly extract secret AES-256 encryption keys from a distance of one metre. They said that the attack can be carried out by people on all budgets and with all kinds of means. <\/p>\n
\"The recording hardware can range from extremely high-end radio equipment, down to 20 USB SDRs. We have found that even the cheap USB dongles can be used to attack software implementations!\" they said. \"This is not a game exclusively for nation states, but also anyone with pocket money and some free time (PDF).\" <\/p>\n
Usually, such an attack would require direct access and manipulation, but Fox-IT found that it was possible just to swan past the target with a bag of wires and small screws and catch a winner in record time. <\/p>\n
\"Using this approach only requires us to spend a few seconds guessing the correct value for each byte in turn (256 options per byte, for 32 bytes so a total of 8192 guesses),\" boasts the firm. <\/p>\n
\"In contrast, a direct brute-force attack on AES-256 would require 2256 guesses and would not complete before the end of the universe\" <\/p>\n
The next challenge is distance. Currently, Fox-IT has met reached a goal of 30cm but says that afull meter is a possibility given the right circumstances. <\/p>\n
\"Our work here has shown a proof of concept for TEMPEST attacks against symmetric crypto such as AES-256. To the best of our knowledge, this is the first public demonstration of such attacks. The low bandwidth requirements have allowed us to perform the attack with surprisingly cheap equipment (20 radio, modest amplifiers and filters) at significant distances,\" it added. <\/p>\n
\"In practice this setup is well suited to attacking network encryption appliances. Many of these targets perform bulk encryption (possibly with attacker controlled data) and the ciphertext is often easily captured from elsewhere in the network.\" <\/p>\n
<\/p>\n