  There can be performance and vulnerability concerns with block ciphers, thus
stream ciphers can used as an alternative. Although many symmetric key stream
ciphers are fairly resistant to side-channel attacks, cryptographic artefacts
may exist in memory. This paper identifies a significant vulnerability within
OpenSSH and OpenSSL and which involves the discovery of cryptographic artefacts
used within the ChaCha20 cipher. This can allow for the cracking of tunneled
data using a single targeted memory extraction. With this, law enforcement
agencies and/or malicious agents could use the vulnerability to take copies of
the encryption keys used for each tunnelled connection. The user of a virtual
machine would not be alerted to the capturing of the encryption key, as the
method runs from an extraction of the running memory. Methods of mitigation
include making cryptographic artefacts difficult to discover and limiting
memory access.
