Comment: Re:"overclocking" machines vulnerable (Score 1) 173
This research shows it's feasible. As others have said, there are a multitude of crypto-systems for which it is worthwhile to determine the private key.
* Determining what algorithm is used isn't that hard. Most are 'off the shelf'. Modifying cryptographic algorithms is almost always a no-no, as it requires heavy resources to ensure it's still accurately safe.
* Determining when an RSA algorithm runs is also not as hard. First, turn down the clock speed. Second, check the energy input/output. This gives a fairly good idea which sort of statements are executed. And then match it to RSA.
* Inducing faults at the proper time then isn't also that hard. Again, turn down clock speed, and do it a couple of times.
In short, it has been done. If there's a one in 50 chance that you insert a proper glitch... and each glitch exposes one bit of the private key, then you'd (only) need 256 successfull glitches. Maybe you can cut it short to, say 200 (as the last 56 you can guess, which might be quicker/easier), so it would require some 1000 break-attempts.
That's still far short of the 2^255 which you'd need to guess the key.
And for expensive systems, it could mean good money.
If I were to pay a couple of students $2000 for a week of dull work, they'd probably do it for me...
