NinjaLab

NinjaLab is a company specialized in the analysis and improvement of the security of cryptographic implementations - [email protected]

[NinjaLab @NinjaLabFr]

The paper, entitled "Handling Noisy Plaintext Checking Oracles With SPiRiT - Application to Kyber" demonstrates the high resilience to noise of oracles-based attacks. Significantly raising the practical threat of side-channel attacks on ML-KEM.

Looking forward to see you !

[NinjaLab @NinjaLabFr]

Thomas Roche will be attending PQcrypto 2026 this week in Saint Malo - https://t.co/ERkPOPA2Bt

Wednesday morning Paco Poilbout  will be presenting his work on ML-KEM side-channel analysis, conducted during his master's internship at NinjaLab and LIRMM.

[Denis Laskov 🇮🇱 @it4sec]

A flaw in Infineon’s security microcontrollers made it possible to extract secret keys using a lab setup that cost just $11,000. 📟🔑👊🏻👨‍💻

More details on:
LinkedIn: https://t.co/ZbC0Zwlmlg
Substack: https://t.co/mnmknC7Ddn

[Antriksh (Yoda) #hardwear_ioNL2025 @antriksh_s]

@it4sec Here is the link to the #talk by Thomas https://t.co/uvdcXF0HrQ #hardwear_io @NinjaLabFr

[NinjaLab @NinjaLabFr]

Malek Sfaxi (aka @YoursSto), our new ninja currently intern at @NinjaLabFr , co-organizes the @N0PSctf , a 36 hours capture-the-flag challenge which will happen from 31 of May to 1 of June 2025.

Feel free to participate !

https://t.co/WX1d2OigOs

[NinjaLab @NinjaLabFr]

We are proud to announce that a conference paper about #EUCLEAK (SCA attack against Infineon secure elements affecting Yubikeys: https://t.co/CUqmlUTRh8) has been accepted to @IEEESSP 2025.

Thomas will be there next week to present his work, if you are in SF, come and say hi!

[hardwear.io @hardwear_io]

In case you missed it…Breaking Down the EUCLEAK Attack! 🤯

Thomas Roche at #hw_ioNL2024 explained it’s impact on YubiKey 5 Series and Infineon Security Systems

YouTube Link: https://t.co/q5YENwC8A7

#EUCLEAKAttack #sidechannel #hardwaresecurity

[NinjaLab @NinjaLabFr]

Thanks to Laurent Imbert (@CNRS research director and PhD advisor), @lirmm_ and @umontpellier for having allowed that 🙏

[NinjaLab @NinjaLabFr]

Today Camille Mutschler, the first @NinjaLabFr employee, successfully defended her PhD thesis about post-quantum cryptography and side-channel attacks, in front of a jury of world-renowned cryptography researchers !

Congratulations to her 👩‍💻👩‍🎓🥳

[Victor LOMNE @victorlomne]

For people attending @EUCyberWeek this week in Rennes, do not miss today the presentation of my associate Thomas Roche about his last research work #EUCLEAK, a side-channel vulnerability impacting the ECDSA implementation of all secure elements of @Infineon

[SecSea 2K25 @SecSeaConf]

⏰ Speaker Announcement - SecSea 2K24 🚨
🎤 Thomas Roche @NinjaLabFr présentera EUCLEAK, une vulnérabilité découverte après 14 ans chez Infineon, impactant les clés FIDO comme YubiKey.
📅 Vendredi 11 octobre à 14h
🎟️: https://t.co/1hkGkEuiCZ
#SecSea2024 #EUCLEAK #Cryptography

[NinjaLab @NinjaLabFr]

Press release from BSI about 𝐄𝐔𝐂𝐋𝐄𝐀𝐊 vulnerability. German only, here is the Google translated version:

https://t.co/cAu9jaVR1C

[NinjaLab @NinjaLabFr]

We are very excited to share our last research work: 𝐄𝐔𝐂𝐋𝐄𝐀𝐊, authored by Thomas Roche.

An electromagnetic Side-Channel Vulnerability in the ECDSA implementation of all Infineon security microcontrollers, notably impacting all YubiKey 5 Series.

https://t.co/CUqmlUTRh8

[hardwear.io @hardwear_io]

⚠️ Unearthing a Side-Channel Vulnerability Undetected for 14 Years! 🚨

Join Thomas Roche at #hw_ioNL2024 to dive deep into a critical side-channel flaw in Infineon Technologies' secure elements—missed in 80+ high-level Common Criteria assessments

More: https://t.co/gMIqD05xxh

[NinjaLab @NinjaLabFr]

@fabian_bader We checked on a vulnerable YubiKey 5C: on the acquired traces the ECDSA signature with the attestation key is easily identifiable and then EUCLEAK must apply.
In fact this was already covered by Yubico advisory (see section "Attestation"): https://t.co/YXbG57QjcZ

[NinjaLab @NinjaLabFr]

@fabian_bader We didn't try but it should be possible on vulnerable FIDO devices

[NinjaLab @NinjaLabFr]

@jasperrrry A PIN is not necessarily enforced on FIDO devices

[NinjaLab @NinjaLabFr]

@RenaudDUBOIS10 This attack is very specific to Infineon implementation. It is not running inside a phone secure enclave (AFAIK).

[NinjaLab @NinjaLabFr]

@shitestfan EdDSA is not impacted as it does not need to compute a modular inverse.

[NinjaLab @NinjaLabFr]

For a complete list of Yubico impacted products:
https://t.co/EXfbK1qfYD