Lucky 13

Lucky 13 is a timing attack on TLS/DTLS discovered in 2012 by Nadhem AlFardan and Kenny Paterson. In 2013 they published their findings and released their whitepaper. The attack is shown to only work on LAN and is hindered by noise on the network (unwanted traffic).

To understand the attack, first explanation of a few concepts is needed.

Basics

Cipher Block Chaining (CBC) and MAC-then-encrypt are being used in the DTLS record protocol.

Cipher Block Chaining (CBC)

CBC is a method of encrypting plaintext. It takes a block of clear text and adds it (bit-by-bit) to the previous encryption.

IV = Initialization Vector is a (pseudo)random sequence of characters added to an encryption key. The IV should be different for any two messages encrypted with the same cryptography key. First step is to divide the pain text into block size (size depends on underlying symmetric encryption algorithm). Plain text ($P_{i}$) and previous ciphertext (Failed to parse (MathML with SVG or PNG fallback (recommended for modern browsers and accessibility tools): Invalid response ("Math extension cannot connect to Restbase.") from server "https://wikimedia.org/api/rest_v1/":): {\displaystyle \C_{i−1}} ) are combined with an XOR operation. Then it gets encrypted with the key. Repeat. In the first step we do not have any ciphertext ($C_{i}$) so we use the IV (initialization vector) for this one. $E$ stands for the encryption process.

This leaves us with this formula:

$C_{i}=E(P_{i}\oplus C_{i-1})$