[Homebrewer]

For crypto holders out there, do be wary of your keys/wallets:

The YubiKey 5, the most widely used hardware token for two-factor authentication based on the FIDO standard, contains a cryptographic flaw that makes the finger-size device vulnerable to cloning when an attacker gains temporary physical access to it, researchers said Tuesday.

The cryptographic flaw, known as a side channel, resides in a small microcontroller used in a large number of other authentication devices, including smartcards used in banking, electronic passports, and the accessing of secure areas. While the researchers have confirmed all YubiKey 5 series models can be cloned, they haven’t tested other devices using the microcontroller, such as the SLE78 made by Infineon and successor microcontrollers known as the Infineon Optiga Trust M and the Infineon Optiga TPM. The researchers suspect that any device using any of these three microcontrollers and the Infineon cryptographic library contains the same vulnerability.

Source: https://arstechnica.com/security/2024/09...e-channel/

[GeneralGrievous]

copy paste the key

[H4K]

Just have to make sure that your hardware wallet doesn't use the same microcontroller.
Obviously limit physical access to it in any case.

[davenporttroy]

>The offline phase took us about 24 hours; with more engineering work in the attack development, it would take less than one hour
>CVSS 4.9


seems to me that it's just academics jerking off, again

[joepa]

So a flaw in the crypto libe right, and not affecting RSA?

[davenporttroy]

So a flaw in the crypto libe right, and not affecting RSA?

No it's not affecting RSA, it's in the Extended Euclidean Algorithm that's used for modular inversion in ECDSA

[shanxixx]

This is bad but not too terrible. This attack requires physical access.
With normal usage, you're still safe from key stealing malware, and if you added a PIN you are still safe.