Video-Based Cryptanalysis: Extracting Cryptographic Keys from Video Footage of a Device’s Power LED

Ben Nassi; Etay Iluz; Or Cohen; Ofek Vayner; Dudi Nassi; Boris Zadov; Yuval Elovici

Paper 2023/923

Video-Based Cryptanalysis: Extracting Cryptographic Keys from Video Footage of a Device’s Power LED

Ben Nassi

, Ben-Gurion University of the Negev

Etay Iluz, Ben-Gurion University of the Negev

Or Cohen, Ben-Gurion University of the Negev

Ofek Vayner, ofekvay@post.bgu.ac.il

Dudi Nassi, Ben-Gurion University of the Negev

Boris Zadov, Ben-Gurion University of the Negev

Yuval Elovici, Ben-Gurion University of the Negev

Abstract

In this paper, we present video-based cryptanalysis, a new method used to recover secret keys from a device by analyzing video footage of a device’s power LED. We show that cryptographic computations performed by the CPU change the power consumption of the device which affects the brightness of the device’s power LED. Based on this observation, we show how attackers can exploit commercial video cameras (e.g., an iPhone 13’s camera or Internet-connected security camera) to recover secret keys from devices. This is done by obtaining video footage of a device’s power LED (in which the frame is filled with the power LED) and exploiting the video camera’s rolling shutter to increase the sampling rate by three orders of magnitude from the FPS rate (60 measurements per second) to the rolling shutter speed (60K measurements per second in the iPhone 13 Pro Max). The frames of the video footage of the device’s power LED are analyzed in the RGB space, and the associated RGB values are used to recover the secret key by inducing the power consumption of the device from the RGB values. We demonstrate the application of video-based cryptanalysis by performing two side-channel cryptanalytic timing attacks and recover: (1) a 256- bit ECDSA key from a smart card by analyzing video footage of the power LED of a smart card reader via a hijacked Internet-connected security camera located 16 meters away from the smart card reader, and (2) a 378-bit SIKE key from a Samsung Galaxy S8 by analyzing video footage of the power LED of Logitech Z120 USB speakers that were connected to the same USB hub (that was used to charge the Galaxy S8) via an iPhone 13 Pro Max. Finally, we discuss countermeasures, limitations, and the future of video-based cryptanalysis in light of the expected improvements in video cameras’ specifications.

Note: More details: https://www.nassiben.com/video-based-crypta

Metadata

Available format(s): PDF
Category: Attacks and cryptanalysis
Publication info: Preprint.
Keywords: cryptanalysis side-channel attacks
Contact author(s): nassib @ post bgu ac il
etayil @ post bgu ac il
Ora2 @ post bgu ac il
nassid @ post bgu ac il
zadov @ post bgu ac il
elovici @ bgu ac il
History: 2023-06-14: approved; 2023-06-13: received; See all versions
Short URL: https://ia.cr/2023/923
License: CC BY-NC

BibTeX

@misc{cryptoeprint:2023/923,
      author = {Ben Nassi and Etay Iluz and Or Cohen and Ofek Vayner and Dudi Nassi and Boris Zadov and Yuval Elovici},
      title = {Video-Based Cryptanalysis: Extracting Cryptographic Keys from Video Footage of a Device’s Power {LED}},
      howpublished = {Cryptology {ePrint} Archive, Paper 2023/923},
      year = {2023},
      url = {https://eprint.iacr.org/2023/923}
}