[Cryptography] Side channel nomenclature

[Ray Dillinger]

On Mon, 2020-06-22 at 17:52 -0400, Phillip Hallam-Baker wrote:
> I am looking into making some videos on side channel attacks. There
> are two separate types of attack I am looking at.
> 
[clip]
> The second I am calling 'exfiltration' in which the system designer
> intentionally leaks information. For example, Dual EX RNG, or Moti
> Yung's smuggling the RSA seed in the top bits of an RSA modulus.

I have always used 'Data Exfiltration' to mean sneaking stolen data out
of a secured environment, regardless of how it was stolen.  You're
extending it AFAIK when you apply it to hardware - at that point it's
necessarily using a mechanism put there by the designer.  But I've
always used it (and heard it used) to refer to data getting stolen from
a human organization like a business or government.  

What gets read off your hard drive (or out of your photocopier, or your
print buffer, or your always-listening Alexa/Whatever, or out of your
employee's fitbits (don't laugh, there's tracking information in
there....) by malware that someone has sneaked into your organization
has to get back to the data thief somehow, and needs to go through the
outbound firewall, without setting off network monitors, and without
alerting the people who read the logs (if there are people who read
logs).  

So it gets transmitted through 'ping' packets that have a bunch of data
attached, or dumped into bogus DNS requests that are never really
monitored, or encoded as HTTP requests, which can get out if your
employees are allowed to use the WWW, or mixed into the general "dull
roar" of a file-sharing protocol as "error" packets, or ... hell, if
the hacker can get at your electrical system, it might even leave the
building through a window as tiny transient power fluctuations that
cause a lightbulb to 'flicker', in such small time increments as to be
imperceptible to humans, and the channel can be read from across the
street.

God, whole ENCYCLOPEDIA VOLUMES could be written about how hackers
exfiltrate data.  But I had only ever considered the word to apply to
human-scale organizations, never to individual pieces of hardware. 

				Bear