CVE-2019-15809 : Exploit Details and Defense Strategies
Learn about CVE-2019-15809 affecting smart cards by Athena SCS, exposing private keys due to a timing side channel vulnerability in ECDSA signature generation. Find mitigation steps and impacted systems.
Smart cards manufactured by Athena SCS, based on the Atmel Toolbox 00.03.11.05 and the AT90SC chip, have a timing side channel vulnerability in ECDSA signature generation, potentially exposing private keys.
Understanding CVE-2019-15809
Smart cards from Athena SCS using Atmel Toolbox 00.03.11.05 and AT90SC chip are vulnerable to a timing side channel attack in ECDSA signature generation.
What is CVE-2019-15809?
The vulnerability allows a local attacker to compute the private key by measuring the duration of signing operations, due to the leakage of the bit length of the random nonce through timing.
The Impact of CVE-2019-15809
- Local attackers can potentially extract private keys from affected smart cards.
- Vulnerable cards include Athena IDProtect, Valid S/A IDflex V, SafeNet eToken 4300, and TecSec Armored Card.
Technical Details of CVE-2019-15809
Smart cards from Athena SCS, utilizing Atmel Toolbox 00.03.11.05 and AT90SC chip, are susceptible to a timing side channel vulnerability in ECDSA signature generation.
Vulnerability Description
- The affected cards use the fast version of ECDSA signature functions, leaking the bit length of the random nonce through timing.
Affected Systems and Versions
- Athena IDProtect 010b.0352.0005
- Athena IDProtect 010e.1245.0002
- Athena IDProtect 0106.0130.0401
- Valid S/A IDflex V 010b.0352.0005
- SafeNet eToken 4300 010e.1245.0002
- TecSec Armored Card 010e.0264.0001
- TecSec Armored Card 108.0264.0001
Exploitation Mechanism
- Local attackers can measure the duration of signing operations to compute the private key.
Mitigation and Prevention
Immediate Steps to Take:
- Implement additional cryptographic protections.
- Monitor for unusual activities related to smart card usage.
Long-Term Security Practices:
- Regularly update smart card firmware and software.
- Conduct security assessments to identify and address vulnerabilities.
- Educate users on secure smart card usage.
- Consider replacing vulnerable smart cards with more secure alternatives.
- Patching and Updates: Stay informed about security patches and updates for smart card systems.