Paul HouleDec 28

⏱️ Constant-time support lands in LLVM: Protecting cryptographic code at the compiler level

https://blog.trailofbits.com/2025/11/25/constant-time-support-lands-in-llvm-protecting-cryptographic-code-at-the-compiler-level/

#llvm #compilers #security #computing #software #sidechannels #cyber

Introducing constant-time support for LLVM to protect cryptographic code

Trail of Bits developed constant-time coding support for LLVM that prevents compilers from breaking cryptographic implementations vulnerable to timing attacks, introducing the __builtin_ct_select family of intrinsics that preserve constant-time properties throughout compilation.

The Trail of Bits Blog
Reddit Tech VN BotNov 12, 2025

Kênh thông tin đáng tin cậy cho giao tiếp giữa các container #CrossContainer #Communication #KênhThôngTin #GiaoTiếpGiữaContainer #SideChannels

https://www.reddit.com/r/programming/comments/1ovcdim/funreliable_sidechannels_for_crosscontainer/

ISEC @ TU GrazSep 5, 2025

This morning, David Oswald started our last day at GSW with his talk "Breaching the Gates: Uncovering Hardware Weaknesses in Confidential Computing", giving an overview of power side-channels and fault attacks in confidential computing scenario. 

#GSW25 #sidechannels

Stefan GastSep 4, 2025

It was fun to hold the software side-channel lab today at Graz Security Week, together with @vmcall and @wayna Thank you both! 🙂

Also thank you to all the participants for your interest and the engaging discussions! 🙂

#GSW25 #sidechannels

ISEC @ TU GrazSep 3, 2025

For our after-lunch-session we hosted a hardware side-channel lab, where our participants used physical side-channel attacks to break the security of embedded devices.

#GSW25 #Hardware #SideChannels

ISEC @ TU GrazSep 3, 2025

In our second morning session, Stefan Mangard and Daniel Gruss aka @lavados spoke about side-channel attacks in various settings - from phones to computers to networks - showing that side channels really are everywhere.

#GSW25 #SideChannels

DIMVA ConferenceJul 4, 2025

Only 5️⃣ more days until DIMVA‘25!

We kickstart the conference on Wednesday with our welcome event, exploring the old town of Graz during a city tour. See you there!

#DIMVA25 #Conference #WebSecurity #Vulnerability #VulnerabilityDetection #SideChannels #Obfuscation #OS #Network #AndroidPatches #AI #ML #ResilientSystems

stfMar 28, 2025

here's the paper for the #RealWorldCrypto talk from yesterday where they extracted an AES key modulated by interference onto the bluetooth signal: https://ia.cr/2025/559

#rwc #crypto #sidechannels

Is Your Bluetooth Chip Leaking Secrets via RF Signals?

In this paper, we present a side-channel attack on the hardware AES accelerator of a Bluetooth chip used in millions of devices worldwide, ranging from wearables and smart home products to industrial IoT. The attack leverages information about AES computations unintentionally transmitted by the chip together with RF signals to recover the encryption key. Unlike traditional side-channel attacks that rely on power or near-field electromagnetic emissions as sources of information, RF-based attacks leave no evidence of tampering, as they do not require package removal, chip decapsulation, or additional soldered components. However, side-channel emissions extracted from RF signals are considerably weaker and noisier, necessitating more traces for key recovery. The presented profiled machine learning-assisted attack can recover the full encryption key from 90,000 traces captured at a one-meter distance from the target device, with each trace being an average of 10,000 samples per encryption. This is a twofold improvement over the correlation analysis-based attack on the same AES accelerator.

IACR Cryptology ePrint Archive
stfMar 28, 2025
wow, the last session of todays #RealWorldCrypto on #sidechannels was a blast, first E. Ronen shows microarchitectural weird gates built out of branch-prediction and addresses in cache, which he then uses to run game of life, and build a timer with accuracy of 5 cycles to deploy in timing side chan attacks. #rwc2025 1/3
LisPiFeb 3, 2025
One issue I consider to remain with low-latency mixnets and overlay networks is that downtime can be deanonymizing.

Even if one has constant bitrate with randomly-selected short downtime/network degradation simulation, that doesn't really help when one's town loses power entirely a few times in a year or whatever and someone bothers to try and map the downtimes onto known locations of power outages over the same year.

Is there any sensible model for handling this failure case?

#Mixnet #TimingAnalysis #SideChannels #Anonymization #Deanonymization #WhyNoDirectTagEditingInAPObjectsYet