Rowhammer-like attack on SSDs can provide root privileges to attacker

Re:Rowhammer-like attack on SSDs can provide root privileges... by street on Wednesday August 16, 2017 @03:43PM (#15030574)

Does flipping a bit in the ciphertext not flip the same bit in the plain text, for naive implementations?

[ Parent | on HN ]

Re:Rowhammer-like attack on SSDs can provide root privileges... by czinck on Wednesday August 16, 2017 @04:59PM (#15031332)

AES and similar algorithms are specifically designed to not do that, because otherwise details of the ciphertext leak details about the plaintext. https://en.wikipedia.org/wiki/Differential_cryptanalysis is about exploiting any unintentional leak of info like that.

[ Parent | on HN ]

Re:Rowhammer-like attack on SSDs can provide root privileges... by rocqua on Wednesday August 16, 2017 @05:56PM (#15031720)

AES in CTR mode does work like that. So do most stream ciphers.

Differential cryptanalysis is not about defending against bit-flips. Instead, it is about comparing two cipher texts to learn something about the relation between corresponding plain-text.

This is only possible on AES-CTR if you have to ciphertexts with the same key and nonce/IV. This is why a nonce is supposed to be used only once. Same goes for other xor based stream ciphers.

[ Parent | on HN ]

Re:Rowhammer-like attack on SSDs can provide root privileges... by dmitrygr on Wednesday August 16, 2017 @03:45PM (#15030590)

No because of SubBytes step

[ Parent | on HN ]