Timing attack beats cryptographic keys.

To foil eavesdroppers, banks and other businesses handling electronic transactions have turned to various forms of cryptography to scramble and hide sensitive information.

Now, a researcher has identified a potentially serious vulnerability in certain widely used cryptosystems. This flaw may threaten the security of encrypted data transfers across computer networks.

Cryptography expert Paul C. Kocher, an independent digital security consultant in Stanford, Calif., posted his findings this week on the Internet. "The general idea of the attack is that secret keys can be found by measuring the amount of time used to process messages," he says.

Kocher's approach applies to public-key cryptosystems. In such schemes, each person gets a pair of keys, or sets of numbers used in a computer program for encrypting and decrypting messages. One key is published openly, so anyone can use it to encrypt a message. But only the recipient knows the corresponding private key needed to unscramble it.

Kocher discovered that these cryptosystems often take slightly different amounts of time to decrypt different messages. By surreptitiously measuring the duration of many such operations, an attacker can accumulate enough data to deduce the private key and read the confidential information.

"The attacks are particularly alarming because they often require only known ciphertext, work even if timing measurements are somewhat inaccurate, are computationally easy, and are difficult to detect," Kocher says.

"This is a real problem, especially for keys that stay around for a long time," says Peter G. Neumann of SRI International in Menlo Park, Calif.

Attacks that involve keeping track of how long operations take have been considered in the past, but they were of real interest only to such groups as the National Security Agency. The increasing use of public-key cryptography in commercial dealings on computer networks has now focused new attention on these concerns.

"You have to take it seriously," says Joan Feigenbaum of AT&T Bell Laboratories in Murray Hill, N.J. "But that doesn't mean this weakness is fatal."

Researchers are already considering cryptographic schemes that take the same amount of time for all possible keys or use additional randomizing to disguise the time that operations require.

Kocher's report is posted on the World Wide Web at the address http://www.cryptography.com/.