Extracting keys from FPGAs, OTP Tokens and Door Locks Side-Channel - - PowerPoint PPT Presentation

▶
extracting keys from fpgas
SMART_READER_LITE
LIVE PREVIEW

Extracting keys from FPGAs, OTP Tokens and Door Locks Side-Channel - - PowerPoint PPT Presentation

Sep 05, 2022 243 likes •1.2k views

Extracting keys from FPGAs, OTP Tokens and Door Locks Side-Channel (and other) Attacks in Practice David Oswald david.oswald@rub.de No, I did not do all this stuff alone Christof Paar Benedikt Driessen Timo Kasper Gregor Leander

slide-1
SLIDE 1

Extracting keys from FPGAs, OTP Tokens and Door Locks

David Oswald david.oswald@rub.de Side-Channel (and other) Attacks in Practice

slide-2
SLIDE 2

2

No, I did not do all this stuff alone

  • Christof Paar
  • Benedikt Driessen
  • Timo Kasper
  • Gregor Leander
  • Amir Moradi
  • Falk Schellenberg
  • Daehyun Strobel
  • Pawel Swierczynski
  • Bastian Richter

If you wondered about my shirt: http://fb.com/World BeatClubTanzenUndH elfen

slide-3
SLIDE 3

3

slide-4
SLIDE 4

4

Sabre: Madboy74

slide-5
SLIDE 5

5

Ruhr-University Bochum: beautiful.

slide-6
SLIDE 6

6

Announcement

  • Timo at 29C3: „ChameleonMini in 2013“
  • As of December 22, 2013:

https://github.com/skuep/ChameleonMini

slide-7
SLIDE 7

Embedded systems everywhere

slide-8
SLIDE 8

8

(The life of) a typical pirate

Pegleg Eye patch Pirate hat Pirate laughter

slide-9
SLIDE 9

9

slide-10
SLIDE 10

10

slide-11
SLIDE 11

11

slide-12
SLIDE 12

12

slide-13
SLIDE 13

13

Report flaws Improve

slide-14
SLIDE 14

Implementation Attacks: …

slide-15
SLIDE 15

15 Based on Skoborogatov

slide-16
SLIDE 16

16

Principle of Side-Channel Analysis

(here: listen to sound)

A Bank Robbery

slide-17
SLIDE 17

17

Principle of Side-Channel Analysis The world is changing…

slide-18
SLIDE 18

18

Principle of Side-Channel Analysis

(Now: measure the power consumption / EM)

The world is changing … … the tools are, too.

slide-19
SLIDE 19

19

Side-Channel Analysis: Leakage

Power consumption / EM depends on processed data

Data = 1111 Data = 0000 Data = 1010

slide-20
SLIDE 20

20

Evaluation Methods: SPA

Simple Power Analysis: Directly analyze (few) traces, for example RSA:

slide-21
SLIDE 21

21

Evaluation Methods: DPA / CPA Differential Power Analysis

  • Detect statistical dependency:

Key guess ⟺ Side-channel

  • Idea: Brute-force w/ additional information
  • Use a statistical test...
slide-22
SLIDE 22

22 Source: phdcomics.com

Wrong key candidate(s) Correct key candidate 100 – 1 mio. measurements

slide-23
SLIDE 23

Implementation Attacks:

From Theory to Practice

slide-24
SLIDE 24

24

Case Studies

Locking system Yubikey 2 Altera Stratix II

slide-25
SLIDE 25

25

Home Port t Bochu hum

slide-26
SLIDE 26

26

FPGA A 20 2013

slide-27
SLIDE 27

27

Case Studies

Locking system Yubikey 2 Altera Stratix II

slide-28
SLIDE 28

28

FPGAs widely used in

  • Routers
  • Consumer products
  • Cars
  • Military

Problem: FPGA design (bitstream) can be easily copied

FPGAs

slide-29
SLIDE 29

29

FPGA 1 Flash Bitstream

FPGA Power-Up

slide-30
SLIDE 30

30

FPGA 1 Flash Bitstream FPGA 2

Clone

Problem: Cloning

slide-31
SLIDE 31

31

FPGA 1 Flash Encrypted bitstream

Industry‘s Solution

slide-32
SLIDE 32

32

FPGA 1 Flash Encrypted bitstream

= ?

Industry‘s Solution

slide-33
SLIDE 33

33

Related Work

  • Bitstream encryption scheme of

several Xilinx product lines broken

– Virtex 2 (3DES) – Virtex 4 & 5 (AES256) – Spartan 6 (AES256)

  • Method: Side-Channel Analysis (SCA)
slide-34
SLIDE 34

34

What about Altera?

  • Target: Stratix II
  • Bitstream encryption („design security“)

uses AES w/ 128-bit key

  • Side-Channel Analysis possible?
  • Problem: Proprietary and undocumented

mechanisms for key derivation and for encryption

slide-35
SLIDE 35

35

35

Reverse-Engineering

  • Reverse-engineer proprietary mechanisms

from Quartus II software

  • IDA Pro (disassembler / debugger)
slide-36
SLIDE 36

36

KEY1 / KEY2 file for FPGA

slide-37
SLIDE 37

37

Key derivation real key = f(KEY1,KEY2) KEY1 / KEY2 file for FPGA

slide-38
SLIDE 38

38

Why this key derivation?

  • Real key cannot be set directly
  • Key derivation is performed once when

programming the FPGA

  • Idea: When real key is extracted, KEY1 and

KEY2 cannot be found  Prevent cloning: real key of blank FPGA cannot be set

slide-39
SLIDE 39

39

„real key“ = AESKEY1(KEY2) Is f (KEY1,KEY2) „good“?

slide-40
SLIDE 40

40

40

Good idea?

  • In principle: Yes
  • But: AES (in this form) is not one-way:
  • Pick any KEY1*
  • KEY2* = AES-1

KEY1*(real key)

  • This (KEY1*, KEY2*) leads to same real key
slide-41
SLIDE 41

41

real key = AESKEY1(KEY2)

KEY1 / KEY2 file for FPGA

slide-42
SLIDE 42

42

real key = AESKEY1(KEY2) encreal key(...)

KEY1 / KEY2 file for FPGA

slide-43
SLIDE 43

43

Encrypted block i = AES128real key(IVi)  plain block i Encryption method: AES in Counter mode

slide-44
SLIDE 44

44

Reverse-Engineering: Summary

  • All „obscurity features“ reverse-engineered
  • Further details: file format, coding, ...
  • Black-box  white box
  • Side-channel analysis possible

(target: 128-bit real key)

slide-45
SLIDE 45

45

Side-Channel Attack on Stratix II

slide-46
SLIDE 46

46

slide-47
SLIDE 47

47

Mean trace for unencrypted and encrypted bitstream

slide-48
SLIDE 48

48

Mean trace for unencrypted and encrypted bitstream

slide-49
SLIDE 49

49

Further experiments ...

slide-50
SLIDE 50

50

Recover the 128-bit AES key with 30,000 traces (~ 3 hours of measurement)

slide-51
SLIDE 51

51

Conclusion

  • Full 128-bit AES key of Stratix II can be

extracted using 30,000 traces (3 hours)

  • Key derivation does not prevent cloning
  • Proprietary security mechanisms can be

reverse-engineered from software

  • Software reverse-engineering enables

hardware attack

slide-52
SLIDE 52

52

slide-53
SLIDE 53

53

slide-54
SLIDE 54

54

slide-55
SLIDE 55

55

Case Studies

Locking system Yubikey 2 Altera Stratix II

slide-56
SLIDE 56

56

slide-57
SLIDE 57

57

Token Door lock

Auth. protocol

Black-box

slide-58
SLIDE 58

58

Turning a Black-box into a White-box

Door lock Token

slide-59
SLIDE 59

59

Decapping an IC (1)

White Fuming Nitric Acid (99.5%)

slide-60
SLIDE 60

60

Decapping an IC (2)

slide-61
SLIDE 61

61

Decapping an IC (3)

slide-62
SLIDE 62

62

Decapping an IC (4)

slide-63
SLIDE 63

63

ASIC

  • Gate Array
  • 2µm technology
  • 28 pads, 14 bonded
  • Mixed-signal
  • ~1700/2300 transistors

utilized

slide-64
SLIDE 64

64

ASIC – Logic Description

slide-65
SLIDE 65

65

Turning a Black-box into a White-box

Door lock Token

slide-66
SLIDE 66

66

Microscopic View (1)

FLASH RAM

EEPROM

analog

FUSES

slide-67
SLIDE 67

67

UV-C: Disable Read-Out Protection (1)

slide-68
SLIDE 68

68

UV-C: Disable Read-Out Protection (2)

slide-69
SLIDE 69

69

Extraction + Analysis of Embedded Code

  • After read-out protection disabled: code

readable with standard programmer

  • Reverse-engineering (e.g. IDA Pro)
  • After some time: all details of system known
  • Black-box → white-box
slide-70
SLIDE 70

70

System Design: Weaknesses and Attacks (1)

  • Each token has unique key KT
  • Each lock has installation-wide key KM
  • KT = f(KM, IDT) → single point of failure
  • Obtaining one lock gives access to all doors:

Read-out PIC (as explained before) or perform non-invasive side-channel attack

slide-71
SLIDE 71

71

System Design: Weaknesses and Attacks (2)

  • Problem 1: System uses proprietary cryptography

with „bad“ mathematical properties

  • Problem 2: Re-use of internal values as

„random“ numbers

  • Result: Mathematical attack allows to recover KT

with 3 (unsuccessful) protocol runs with any door

slide-72
SLIDE 72

72

Conclusion

  • Adversary gains full access to any door
  • Reasons for security flaws

– Insecure hardware – Proprietary cryptography – „Bad“ system design

  • Hardware attacks: Replace all devices (expensive)
  • Cryptanalytical attacks: Firmware update (cheap)
  • Hardware reverse-engineering enables

mathematical attacks

slide-73
SLIDE 73

73

slide-74
SLIDE 74

74

slide-75
SLIDE 75

75

RA RAID ID 20 2013

slide-76
SLIDE 76

76

slide-77
SLIDE 77

77

Case Studies

Locking system Yubikey 2 Altera Stratix II

slide-78
SLIDE 78

78

Two-Factor Authentication

Past: One factor: Password/PIN Today: Two factors: Password/PIN and additionally

slide-79
SLIDE 79

79

Yubikey 2: Overview

  • Simulates USB keyboard
  • Generates and enters One-Time

Password (OTP) on button press

  • Based on AES w/ 128-bit key
slide-80
SLIDE 80

80

Yubikey OTP Generation (1)

...

dhbgnhfhjcrl rgukndgttlehvhetuunugglkfetdegjd dhbgnhfhjcrl trjddibkbugfhnevdebrddvhhhlluhgh dhbgnhfhjcrl judbdifkcchgjkitgvgvvbinebdigdfd ...

slide-81
SLIDE 81

81

Yubikey OTP Generation (2) AES-128 Encryption Modhex Encoding

?

slide-82
SLIDE 82

82

Yubikey Hardware

slide-83
SLIDE 83

83

Measurement Setup

  • Resistor in USB ground for power measurement
  • EM measurement with near-field probe
  • Connecting (capacitive) button to ground triggers

the Yubikey

slide-84
SLIDE 84

84

Power vs. EM Measurements

  • Trigger on falling edge (Yubikey's LED off)
  • EM yields better signal
  • AES rounds clearly visible

1 2 3 4 5 6 7 8 9 10

slide-85
SLIDE 85

85

Key Recovery (EM)

  • Attacking final AES round
  • Power model hi = HW(SBOX-1(Ci  rk))
  • ~ 700 traces needed
  • ~ 1 hour for data acquisition

Byte 1 Byte 2 Byte 8 Byte 9

slide-86
SLIDE 86

86

Implications

  • 128-bit AES key of the Yubikey 2 can be recovered

(700 EM measurements = 1 hour physical access)

  • Attacker can compute OTPs w/o Yubikey
  • Impersonate user:

Username and password still needed

  • Denial-of-Service:

Send an OTP with highly increased useCtr → Improved FW version 2.4 for Yubikey 2

slide-87
SLIDE 87

Responsible Disclosure

When pirates do good ...

slide-88
SLIDE 88

88

slide-89
SLIDE 89

89

By RedAndr, Wikimedia Commons

slide-90
SLIDE 90

90

Responsible Disclosure

  • Locking system:

– Vendor informed ~ 1 year before – Deployed patch to fix mathematical attacks

  • Altera:

– Informed ~ 6 months before – Acknowledged our results

  • Yubikey:

– Informed ~ 9 months before – Improved firmware version 2.4

slide-91
SLIDE 91

Countermeasures

slide-92
SLIDE 92

92

Countermeasures

  • Implementation attacks: Practical threat, but:
  • First line of defense: Classical countermeasures

– Secure hardware (certified devices) – Algorithmic level

  • Second line of defense: System level

– Detect: Shadow accounts, logging – Minimize impact (where possible): Key diversification

slide-93
SLIDE 93

93

Different Scenarios, different threats

Yubikey 2

  • Time per key: 1 h
  • Diversified keys (?)
  • Each token: new attack

→ Attack does not scale

Locking system

  • Time per key: 15 min
  • All doors: same key
  • Attack one door

→ Attack scales

slide-94
SLIDE 94

94

slide-95
SLIDE 95

Thanks for your attention Questions now?

  • r later: david.oswald@rub.de

If you wondered about my shirt: http://fb.com/WorldBeatClubTanzenUndHelfen