STMicroelectronics ST33TPHF2ESPI TPM devices prior to 2019-09-12 allow malicious users to extract the ECDSA private key via a side-channel timing attack because ECDSA scalar multiplication is mishandled, aka TPM-FAIL.
| Vulnerable Product | Search on Vulmon | Subscribe to Product |
|---|---|---|
st st33tphf2espi_firmware 71.0 |
||
st st33tphf2espi_firmware 71.4 |
||
st st33tphf2espi_firmware 71.12 |
||
st st33tphf2espi_firmware 73.0 |
||
st st33tphf2espi_firmware 73.4 |
||
st st33tphf2espi_firmware 73.8 |
||
st st33tphf2ei2c_firmware 73.5 |
||
st st33tphf2ei2c_firmware 73.9 |
||
st st33tphf20spi_firmware 74.0 |
||
st st33tphf20spi_firmware 74.4 |
||
st st33tphf20spi_firmware 74.8 |
||
st st33tphf20spi_firmware 74.16 |
||
st st33tphf20i2c_firmware 74.5 |
||
st st33tphf20i2c_firmware 74.9 |
You know what they say: Timing is... everything True to its name, Intel CPU flaw ZombieLoad comes shuffling back with new variant
Trusted Platform Modules, specialized processors or firmware that protect the cryptographic keys used to secure operating systems, are not entirely trustworthy. Boffins from the Worcester Polytechnic Institute and University of California, San Diego, in the US, and the University of Lübeck in Germany, have found that TPMs leak timing information that allows the recovery of the private keys used for cryptographic signatures. In a paper [PDF] published on Tuesday, "TPM-FAIL: TPM meets Timing and...
Vulmon