Implementations of cryptographic libraries have been scrutinized for secret-dependent execution behavior exploitable by microarchitectural side-channel attacks. To prevent unintended leakages, most libraries moved to constant-time implementations of cryptographic primitives. There have also been efforts to certify libraries for use in sensitive areas, like Microsoft CNG and Botan, with specific attention to leakage behavior.
In this work, we show that a common oversight in these libraries is the existence of \emph{utility functions}, which handle and thus possibly leak confidential information. We analyze the exploitability of base64 decoding functions across several widely used cryptographic libraries. Base64 decoding is used when loading keys stored in PEM format. We show that these functions by themselves leak sufficient information even if libraries are executed in trusted execution environments. In fact, we show that recent countermeasures to transient execution attacks such as LVI \emph{ease} the exploitability of the observed faint leakages, allowing us to robustly infer sufficient information about RSA private keys \emph{with a single trace}. We present a complete attack, including a broad library analysis, a high-resolution last level cache attack on SGX enclaves, and a fully parallelized implementation of the extend-and-prune approach that allows a complete key recovery at medium costs.
Design and Implementation of a Controlled Ransomware Framework for Educational Purposes Using Flutter Cryptographic APIs on Desktop PCs and Android Devices
From Neural Intent to Cryptographic Authorization: Securing AI-Driven Enterprise Workflows
Guangzhou University（广州大学）；South China Normal University（华南师范大学）；Dongguan University of Technology（东莞理工学院）；Jinan University（暨南大学）；Shandong University（山东大学）
Cryptographic Backdoor for Neural Networks: Boon and Bane
College of Computing and Data Science, Nanyang Technological University Singapore（南洋理工大学计算与数据科学学院）；Applied Statistics Unit, Indian Statistical Institute（印度统计研究所应用统计单位）
Crypto-ncRNA: a bio-inspired post-quantum cryptographic primitive exploiting RNA folding complexity
Tsinghua University-Peking University Joint Center for Life Sciences, Tsinghua University（清华大学-北京大学联合生命科学中心，清华大学）；Xinjiang Key Laboratory of Biological Resources and Genetic Engineering, College of Life Science and Technology, Xinjiang University（新疆生物资源与基因工程重点实验室，新疆大学生命科学与技术学院）；College of Mathematics and System Science, Xinjiang University（新疆大学数学与系统科学学院）；Department of Industrial and Systems Engineering, Faculty of Engineering, The Hong Kong Polytechnic University（工程学院工业与系统工程系，香港理工大学）；School of Environment and Energy, Shenzhen Graduate School, Peking University（环境与能源学院，北京大学深圳研究生院）
