Lukasz Chmielewski
Łukasz Chmielewski holds the position of Assistant Professor at Masaryk University in Brno, Czech Republic. His primary area of expertise revolves around side-channel analysis (SCA) of public-key cryptosystems. In general, he is also interested in hardware attacks, including fault injection, on real-world devices. Currently, he is actively involved in enhancing the capabilities of the side-channel CRoCS lab. Moreover, in recent years, he has worked on the applications of deep learning to SCA, targeting both symmetric and asymmetric schemes. In the past, he obtained his PhD and was a postdoctoral researcher in the Digital Security Group at Radboud University Nijmegen. He also has significant commercial experience in SCA, FI, and software-security evaluations of embedded devices. His overall practical experience in physical attacks spans the last 13 years.
Session
OpenSSL is the most popular cryptographic library, a cornerstone of secure communication, and its cryptographic internals continue to evolve and therefore deserve scrutiny. In this lightning talk, we present a concise technical overview of how OpenSSL compares to other major libraries in its implementation of elliptic curve cryptography (ECC), based on our analysis using the reverse-engineering tool called pyecsca. We comment on some design decisions, coordinate system choices, and optimizations selected by OpenSSL developers, and how it compares to the broader ecosystem of cryptographic libraries.
We then turn to RSA, where our large-scale analysis reveals subtle, persistent fingerprints in OpenSSL-generated keys. Drawing from our studies published at USENIX and ESORICS, we demonstrate how these fingerprints can be used to attribute keys in the wild, exposing systemic patterns and even detecting unwantedly injected keys, as seen in Estonian electronic IDs in 2017. Moreover, we discuss how our open-source channel tooling can be used to analyze the side-channel security of OpenSSL.
All of this is powered by tools and techniques developed at the Centre for Research on Cryptography and Security (CRoCS) at Masaryk University. We aim to show deep and practical security insights through rigorous tooling and transparency.
Presented by:
Łukasz Chmielewski, Centre for Research on Cryptography and Security (CRoCS), Masaryk University
https://crocs.fi.muni.cz/