There was a joke at the time that although the National Security Agency had opened up in recent years and started taking their defensive role more seriously, the one aspect of cryptography which they would never discuss publicly was side channel attacks — and this itself constituted a side channel, revealing the importance they attributed to the field. Being active in computer security, and recognizing that the NSA knew a few things about the topic, my immediate priority was to determine whether the information leakage I had identified was sufficient to construct a practical cryptographic side channel. By mid-December I had a proof-of-concept exploit which stole enough bits of an RSA private key for the entire key to be reconstructed, and I turned my attention to the hard part of the problem: Quietly notifying security teams and working together to get the issue fixed before disclosing it publicly.
The Duty of a Scholar
Key points
- Anyone involved with open source software security will recognize the process of responsible disclosure (now widely called "coordinated disclosure", after some people in the industry struggled with the concept of responsibility), although the length of this particular process was unusual.
- In this particular case, I was unusually able to put my life on hold: I was single, child-free, and, after defending my thesis and returning home to Canada, living rent-free in my (very tolerant) parents' basement.
- Had I been living in the USA, I would have needed to prioritize seeking employment and medical insurance and likely would not have been able to discharge the duty which fate had thrust upon me.
Sentences selected automatically from the original article by Hacker News.
Story details
- Published
- By
- gslin
- Format
- Article
- Original
- daemonology.net ↗




