Excellent insight driving more secure device software and hardware.

Cryptographic side channels are well-known and understood in the industry. There are also many countermeasures against side channels to reduce the leakage risk. However, many implementations in the field are leaky because of the combination of security experts and the absence of a good pre-silicon side channel analysis tool.

The attack known as Rolling-PWN (CVE-2021-46145) [1] is the latest of a recent series of security issues affecting the car’s immobilizers and RKEs (Remote Keyless Entry, also known as the keyfob or remote control). Over the past years, we have seen how security researchers identified attacks that could open and even start cars from vendors like Tesla [2], Hyundai-Kia [3], VAG (Volkswagen, Audi, Seat, Porsche, Skoda) [4], and others. This time, the targets of Rolling-PWN are Honda vehicles from 2012 to 2022.

Nikola Medic, Director of Sales Certification at Riscure, has been helping customers find the best way to meet their product deployment objectives for more than 5 years. In this interview, Nikola shares his experience with Riscure and explains the significance of Common Criteria certification.

Riscure’s state-of-the-art Side Channel Analysis and Fault Injection software, Inspector, is continuously updated to reflect the new developments in the security industry. Recently, we released the Inspector 2022.1 version. We want to introduce the important updates in this latest version.

Hertzbleed is a new side-channel attack that turns a power side channel into a timing side channel. That timing side channel may be exploitable even if the algorithm runs in a constant number of clock cycles. The novel observation is that the duration of a clock cycle can vary depending on the data processed on a CPU that uses dynamic frequency scaling. This allows a remote attacker to extract cryptographic keys under a few conditions.

The DRM is known to protect and encrypt content in order to deliver it to the device. DRM’s main purpose is to close the gaps in content protection strategies and enable content consumption on different devices to be easily accessible. As DRM technologies have matured, it is expected that their security capabilities will follow.