Hertzbleed Attack (hertzbleed.com)

Article summary

The Hertzbleed attack is a new family of side-channel attacks that exploits dynamic frequency scaling in modern x86 processors to extract cryptographic keys from remote servers. This attack can affect even constant-time cryptographic implementations and has been demonstrated to work against SIKE, a key encapsulation mechanism. The attack has been shown to be practical, with an unoptimized version recovering a full key in 36-89 hours. Disabling frequency boost, such as Turbo Boost, can mitigate the attack, but this may impact performance.

Main themes

• Hertzbleed attack
• side-channel attacks
• cryptographic security
• processor vulnerabilities
• mitigation strategies
• cloud security

What commenters say

• Disabling Turbo Boost can mitigate the Hertzbleed attack, but it may significantly impact performance.
• The attack is unlikely to be practical in real-world scenarios due to noise and variability in network requests.
• Cloud providers, especially second-tier vendors, may be more vulnerable to Hertzbleed attacks due to their use of stock KVM/XEN.
• Javascript may not be a viable vector for Hertzbleed attacks due to limited timer precision.
• Rounding timer values can help mitigate side-channel attacks, but it may not be a foolproof solution.
• The Hertzbleed attack highlights the need for more robust security measures, such as constant-time implementations and secure coding practices.
• The attack's practicality is debated, with some arguing it requires laboratory conditions and others seeing potential for real-world exploitation.