Infineon cryptographic library (ECDSA) in security microcontrollers: Electromagnetic side channel in Infineon's ECDSA

Impact

Electromagnetic side channel in Infineon's ECDSA implementation allows secret key extraction from affected security chips. The library is used well beyond the headline YubiKey case, across Infineon security microcontrollers that also serve as TPMs and platform root-of-trust devices. Where such a chip anchors a fleet's attestation or admin authentication, a cloned credential is indistinguishable from the real one.

Who can reach it

Physical access plus specialised equipment and time with the device. In a datacenter this is not automatically out of scope: a colo cage, an RMA path, a decommissioning contractor, or remote-hands staff all supply that access, and hardware in transit is the classic exposure window.

What to do

Chip firmware cannot be updated in the affected devices - the fix ships only in new hardware revisions. So the answer is inventory, then replacement or acceptance, plus rotating any credential the affected chip holds. For an operator, the practical control is chain-of-custody: tamper-evident sealing, tracked RMA handling, and never returning a root-of-trust device to a pool without re-provisioning.

References