Adding Math to List of Security Threats New York Times (11/17/07) P. B4; Markoff, John
as it appeared in the November 19, 2007 edition of ACM TechNews.
Weizmann Institute of Science professor Adi Shamir recently warned of a hypothetical incident in which a math error in a commonly used computing chip could endanger the security of the global electronic commerce system. Shamir, one of the designers of the RSA public key algorithm, says the increasing complexity of microprocessor chips will almost certainly lead to undetected errors. Similar errors have already been found in older systems, such as the discovery of an obscure division bug in Intel's Pentium microprocessor in 1994 and a multiplication bug found in Microsoft's Excel spreadsheet. A subtle math error would allow an attacker to break the public key cryptography technique by discovering the error in a widely used chip and sending a "poisoned" encrypted message to the computer, allowing the attacker to compute the value of the secret key used by the targeting system. Shamir says the error would allow millions of PCs to be attacked without having to manipulate the operating environment of each one individually. Shamir notes that laws governing trade secrets that protect the exact workings of microprocessor chips make it almost impossible to verify that the chips have been designed correctly. "Even if we assume that Intel had learned its lesson and meticulously verified the correctness of its multipliers," he says, "there are many smaller manufacturers of microprocessors who may be less careful with their design." Click Here to View Full Article
