https://www.computing.co.uk/ctg/news/3012705/aes-256-encryption-cracked-by-dutch-researchers-with-just-usd200-of-equipmentResearchers in the Netherlands claim to have cracked AES-256 standard encryption using little more than $200 of equipment.
Security firm Fox-IT claims, together with another company called Riscure, to have created a method for eavesdropping on security enabled through proximity, in what is known as a side channel attack.
The researchers put together a piece of kit worth less than $200 and were able to wirelessly extract AES-256 encryption keys from a distance of one metre. They suggested that the attack can be carried out by people on all budgets and with all kinds of means.
Researchers in the Netherlands claim to have cracked AES-256 standard encryption using little more than $200 of equipment.
Security firm Fox-IT claims, together with another company called Riscure, to have created a method for eavesdropping on security enabled through proximity, in what is known as a side channel attack.
The researchers put together a piece of kit worth less than $200 and were able to wirelessly extract AES-256 encryption keys from a distance of one metre. They suggested that the attack can be carried out by people on all budgets and with all kinds of means.
"The recording hardware can range from extremely high-end radio equipment, down to €20 USB SDRs. We have found that even the cheap USB dongles can be used to attack software implementations!" they said. "This is not a game exclusively for nation states, but also anyone with pocket money and some free time."
Usually, such an attack would require direct access and manipulation. But Fox-IT found that it was possible just to swan past the target with a bag of SDR, amplifiers, filters, and an antenna and to capture the required information without the target being aware of the attack.
"Using this approach only requires us to spend a few seconds guessing the correct value for each byte in turn (256 options per byte, for 32 bytes — so a total of 8,192 guesses)," claimed Fox-IT.
"In contrast, a direct brute-force attack on AES-256 would require 2^256 guesses and would not complete before the end of the universe."
The next challenge is distance. Currently, Fox-IT has only reached a distance of 30cm but claims that a full meter is possible in the right circumstances.
"Our work here has shown a proof of concept for TEMPEST attacks against symmetric crypto such as AES-256.
"To the best of our knowledge, this is the first public demonstration of such attacks. The low bandwidth requirements have allowed us to perform the attack with surprisingly cheap equipment (€20 radio, modest amplifiers and filters) at significant distances," it added.
"In practice, this setup is well suited to attacking network encryption appliances. Many of these targets perform bulk encryption (possibly with attacker controlled data) and the ciphertext is often easily captured from elsewhere in the network."
