Power Analysis of ECC Hardware Implementations circuitcellar.com - get the latest breaking news, showbiz & celebrity photos, sport news & rumours, viral videos and top stories from circuitcellar.com Daily Mail and Mail on Sunday newspapers.
The vulnerability allows threat actors to recover the encryption key used by the hardware security key to generate cryptographic tokens for two-factor authentication (2FA) operations.
Once obtained, the two security researchers say the ECDSA private key would allow threat actors to clone Titan, YubiKey, and other keys to bypass 2FA procedures.
Attack requires physical access
However, while the attack sounds disastrous for Google and Yubico security key owners, its severity is not what it seems.
In a 60-page PDF report, Victor Lomne and Thomas Roche, researchers with Montpellier-based NinjaLab, explain the intricacies of the attack, also tracked as
CVE-2021-3011.
Une attaque permet de récupérer les clés de chiffrement des clés Google Titan zdnet.fr - get the latest breaking news, showbiz & celebrity photos, sport news & rumours, viral videos and top stories from zdnet.fr Daily Mail and Mail on Sunday newspapers.