New side-channel attack can recover encryption keys from Google Titan security keys
The vulnerability allows threat actors to recover the encryption key used by the hardware security key to generate cryptographic tokens for two-factor authentication (2FA) operations. Once obtained, the two security researchers say the ECDSA private key would allow threat actors to clone Titan, YubiKey, and other keys to bypass 2FA procedures. Attack requires physical access However, while the attack sounds disastrous for Google and Yubico security key owners, its severity is not what it seems. In a 60-page PDF report, Victor Lomne and Thomas Roche, researchers with Montpellier-based NinjaL...
Source: zdnet.com