Kibernetski napadi preko stranskih kanalov

When implementing cryptographic primitives in software, we often resort to optimizing the software code in order to reduce unnecessary computation time. Such decisions can have negative consequences on data leakage outside the implementation. Attackers can exploit the additional information generated by the execution of the software solution in a way that gives them additional insights into the operation of the software, the values calculated and access to the data itself. Insights can be gained in the form of execution time, memory access patterns, power consumption, and other seemingly unrelated system parameters. Such attacks are referred to as “side-channel attacks”. This paper presents several examples of such attacks and the magnitude of information leakage, as well as how to protect against such attacks. Time-based cryptanalysis, power-based cryptanalysis, including a special variant – video-based cryptanalysis – and memory-based cryptanalysis are described. A simple timing cryptanalysis attack is used as an example to present the analysis process and the results before and after the implementation of the proposed mitigation. Članek predstavlja več primerov takšnih napadov in razsežnosti uhajanja informacij ter načinov zaščite pred napadi. Opisane so časovna kriptoanaliza, kriptoanaliza na podlagi porabe energije in njena posebna različica -- kriptoanaliza na podlagi videoposnetka -- ter pomnilniška kriptoanaliza. Na primeru preprostega napada s časovno kriptoanalizo je predstavljen postopek analize in rezultati pred in po implementaciji predlagane zaščite.