The Patching Friars' AlmanacA calendar of CVE saints

September 3

EUCLEAKHoly card for eucleak, generated with AI (Claude, Anthropic) for the Lunario dei Frati Patchatori.CC BY-NC-SA 4.0 ECDSA EUCLEAK CLAVIS EX AETHERE
🤖 Image and text generated with AI

⬇ Download holy card: ·

Embed on your site

Saint EUCLEAK, Who Drew the Key From the Key

Patron of security keys, FIDO tokens, and everyone who thought a hardware key was untouchable.

Life

On 3 September 2024 NinjaLab revealed EUCLEAK, an electromagnetic side channel in the Infineon microcontroller used in many security keys, including YubiKey 5 with firmware before 5.7. With physical access and expensive equipment, measuring the emissions during a signature, one could reconstruct the ECDSA key and clone the token. Hard and costly, but no longer impossible.

Prayer

O Saint EUCLEAK, who listens to the electromagnetic whisper of the signature, let our modular multiplications always take the same time. Amen.

How to celebrate

Celebrated by buying tokens with updated firmware and keeping your security key close.

Key in your pocket, secret in the air.

Technical record

Disclosed on
September 3 2024
CVE
CVE-2024-45678
CVSS
4.2

Yubico YubiKey 5 Series devices with firmware before 5.7.0 and YubiHSM 2 devices with firmware before 2.4.0 allow an ECDSA secret-key extraction attack (that requires physical access and expensive equipment) in which an electromagnetic side channel is present because of a non-constant-time modular inversion for the Extended Euclidean Algorithm, aka the EUCLEAK issue. Other uses of an Infineon cryptographic library may also be affected.

Sources: ninjalab.io

Also remembered today

Shortcuts: ← → to move, D day, W week, M month, T today.

📅 Add to your calendar

SaintsGoogle CalendarApple, Outlook (.ics)

Observances (feasts, scourges and miracles)Google CalendarApple, Outlook (.ics)

In Google Calendar you can also paste the URL in Settings → Add calendar → From URL. The first sync can take a few hours.