A vulnerability inherent in Intel and AMD processors, used in most laptops, desktops and servers, could allow attackers to locate private keys in specific situations. The impact of this flaw seems to be limited to the security of Bitcoin and other cryptocurrencies, but we will explain its characteristics here.
The alert was recently made in the Bitcoin Optech newsletter: American academics had already reported the flaw to Intel, Cloudflare and Microsoft in the third quarter of 2021 and to AMD in the first quarter of 2022. But Intel first called for it would be kept under embargo. until June 14, 2022. The attacker exploiting this flaw would be able to discover private keys when used to create signatures, whether for Bitcoin transactions or for any cryptographic operation other.
To exploit the vulnerability, the attacker would need to be able to measure the CPU chip power consumption or the length of certain parts of the signature operation. Even secure code specifically designed to always use the same type and number of CPU operations (to prevent information leaking to attackers).
In concrete terms, the attack is based on the energy-saving functions of the processors, resulting in a reduction in frequency according to the treatment requirements. Better known as dynamic frequency scaling, they help ensure that the system stays below power and thermal limits (during high CPU loads).
At this point, the importance of this vulnerability for Bitcoin users is not yet entirely clear. Therefore, the vulnerability is more likely to disrupt frequently used active wallets, such as those that use Lightning Network’s hosting services or routing nodes, or where address reuse is. A wallet that is mostly offline or completely or used in secure environments would be much more resistant to attacks.
This type of vulnerability has already been documented for a number of wallets, including well-known hardware signature devices: they use a signature generation code that may compromise power analysis and synchronization. Ultimately, therefore, it would not change much in this context. For applications with more secure code, developers may be able to apply additional protections.
It should be noted that neither Intel nor AMD are planning to deploy microcode patches, if only to limit the influence of HertzBleed. However, Intel has issued guidance to mitigate the vulnerability in software libraries, which developers can take useful advantage of. A quicker approach would be to disable frequency variation, called “Turbo Boost” by Intel and “Turbo Core” by AMD, by intervening directly in the BIOS. This unfortunately costs performance significantly degraded.
In practice, the usability of this fault seems to be greatly reduced and our cryptocurrencies can sleep safely in our purse !
Sources: Bitcoin Optech, Hertzbleed
Get a summary of news in the world of cryptocurrencies by subscribing to our new daily and weekly newsletter service so you don’t miss any of the essential Cointribune!
Claude Bernardini
Computer entrepreneur and resident of African lands for fifteen years. In this uncertain world, I see bitcoin and cryptos as one of the best opportunities to face the challenges ahead.
