[HN Gopher] Is Your Bluetooth Chip Leaking Secrets via RF Signals?
       ___________________________________________________________________
        
       Is Your Bluetooth Chip Leaking Secrets via RF Signals?
        
       Author : transpute
       Score  : 53 points
       Date   : 2025-11-02 18:06 UTC (4 hours ago)
        
 (HTM) web link (www.semanticscholar.org)
 (TXT) w3m dump (www.semanticscholar.org)
        
       | vardump wrote:
       | A side channel attack revealing AES key from just 90,000 traces.
       | 
       | Sigh, side channel attacks seem to be everywhere now.
        
         | sitzkrieg wrote:
         | people are finally aware everything leaks, it's just a matter
         | of how closely you look
        
           | boulevard wrote:
           | Everything leaks if you stare at it long enough
        
             | formerly_proven wrote:
             | There's a lot of signal left between you and the noise
             | floor!
        
               | namibj wrote:
               | Worse: noise floor is a matter of definition.
        
             | czbond wrote:
             | Everything has data exhaust.... the exhaust type just
             | differs.
        
         | barbegal wrote:
         | That 90,000 traces did take 225 hours to capture so it is truly
         | a huge amount of data and not a trivial attack.
        
           | karlgkk wrote:
           | On the other hand, I'd argue that it's close enough to
           | trivial to be considered trivial. How many embedded devices
           | transmit sensitive information?
           | 
           | Now, I know that pretty much every Bluetooth based credit
           | card reading device explicitly defends against a channel such
           | as this, but there are tons of access control solutions, and
           | medical devices that don't
           | 
           | Would you notice a raspberry pi tucked into the mess of wires
           | beneath the security guard guards desk?
        
             | throwaway89201 wrote:
             | > How many embedded devices transmit sensitive information?
             | 
             | Every Zigbee device uses AES keys to secure the network,
             | although the security of the protocol is pretty weak in
             | most deployments, especially when new devices join the
             | network. Leaking the network key would provide access to
             | the entire network. The ARM Cortex-M4 is often used, which
             | the side-channel attack in the article is about.
        
       | 3abiton wrote:
       | I read the abstract, while not familiar with the topic, how would
       | we go about limiting the inpact?
        
         | Retr0id wrote:
         | Rotating keys frequently would probably help. But the best
         | thing to do is use implementations that are less leaky in the
         | first place (which is easier said than done)
         | 
         | Wireguard REKEY_AFTER_MESSAGES, REKEY_AFTER_TIME parameters
         | would be an example of this although the design motivations
         | there were PFS rather than side-channel resistance.
        
       ___________________________________________________________________
       (page generated 2025-11-02 23:00 UTC)