Side Channel Attacks and Countermeasures for Embedded Systems Job - - PowerPoint PPT Presentation

▶
side channel attacks and countermeasures for embedded
SMART_READER_LITE
LIVE PREVIEW

Side Channel Attacks and Countermeasures for Embedded Systems Job - - PowerPoint PPT Presentation

Sep 26, 2023 111 likes •537 views

Side Channel Attacks and Countermeasures for Embedded Systems Job de Haas Black Hat USA August 2, 2007 Black Hat USA 2007 Agenda Advances in Embedded Systems Security From USB stick to game console Current attacks

slide-1
SLIDE 1

Black Hat USA 2007

Side Channel Attacks and Countermeasures for Embedded Systems

Job de Haas

Black Hat USA August 2, 2007

slide-2
SLIDE 2

Black Hat USA 2007

Agenda

  • Advances in Embedded Systems Security

– From USB stick to game console – Current attacks – Cryptographic devices

  • Side Channels explained

– Principles – Listening to your hardware – Types of analysis

  • Attacks and Countermeasures

– Breaking a key – Countermeasures theory – Practical implementations

slide-3
SLIDE 3

Black Hat USA 2007

Security in embedded systems

slide-4
SLIDE 4

Black Hat USA 2007

Trends in embedded hardware security

  • Preventing debug access

– Fuses, Secure access control

  • Protecting buses and memory components

– Flash memories with security, DRAM bus scrambling

  • Increase in code integrity

– Boot loader ROM in CPU, Public key signature checking

  • Objectives:

– Prevent running unauthorized code – Prevent access to confidential information

  • Effective against most “conventional” attacks
slide-5
SLIDE 5

Black Hat USA 2007

Popular ‘hardware’ attacks

slide-6
SLIDE 6

Black Hat USA 2007

Attacks on glue and BGA

  • Cheap BGA reballing

in phone unlocking and repair

  • Glue can be removed

with chemicals or hot air

(See also Joe Grand’s BH presentations on hardware attacks)

slide-7
SLIDE 7

Black Hat USA 2007

Towards cryptographic devices

  • Smart cards represent the ultimate cryptographic device:

– Operate in a hostile environment – Perform cryptographic operations on data – Harnessing both the cryptographic operation and the key – Tamper resistant

  • General purpose processors are incorporating more and more

smart card style security

  • Why not use a smart card?

– Also adds complexity – How to communicate securely with it? – Some do (PayTV, TPM etc)

slide-8
SLIDE 8

Black Hat USA 2007

Agenda

  • Advances in Embedded Systems Security

– From USB stick to game console – Current attacks – Cryptographic devices

  • Side Channels explained

– Principles – Listening to your hardware – Types of analysis

  • Attacks and Countermeasures

– Breaking a key – Countermeasures theory – Practical implementations

slide-9
SLIDE 9

Black Hat USA 2007

Side Channel Analysis

  • What?

– read ‘hidden’ signals

  • Why?

– retrieve secrets

  • How?

– Attack channels – Methods – Tools

slide-10
SLIDE 10

Black Hat USA 2007

Attack Channels

  • Time
  • Power consumption
  • Electro-Magnetic radiation
  • Light emission
  • Sound
slide-11
SLIDE 11

Black Hat USA 2007

Passive versus active attacks

  • Passive attacks

– Only observing the target – Possibly modifying it to execute a specific behavior to observe – Examples: time, power or EM measurements

  • Active attacks

– Manipulating the target or its environment outside of its normal behavior – Uncovering cryptographic keys through ‘fault injection’ – Changing program flow (eg. circumvent code integrity checks) – Examples: Voltage or clock glitching, laser pulse attacks

slide-12
SLIDE 12

Black Hat USA 2007

Principle of timing analysis

Process 2 Process 2 Process 2 Start Start Start End End End Decision Decision Decision Process 1 Process 1 Process 1

t = 10ms t = 10ms t = 20ms t = 20ms

slide-13
SLIDE 13

Black Hat USA 2007

  • Semiconductors use current while

switching

  • Shape of power consumption profile

reveals activity

  • Comparison of profiles reveals

processes and data

  • Power is consumed when switching from

1→0 or 0→1

Principle of power analysis

slide-14
SLIDE 14

Black Hat USA 2007

Principle of electromagnetic analysis

  • Electric and Magnetic field are related to current
  • Probe is a coil for magnetic field
  • Generally the near field (distance << λ) is most suitable
  • Adds dimension position compared to the one dimensional

power measurement

slide-15
SLIDE 15

Black Hat USA 2007

Side channel analysis tools

  • Probes

– Power: Intercept power circuitry with small resistor – EM: Coil with low noise amplifier

  • Digital storage oscilloscope
  • High bandwidth amplifier
  • Computer with analysis and control software
slide-16
SLIDE 16

Black Hat USA 2007

Test equipment

  • CPU: Ti OMAP 5912 150Mhz
slide-17
SLIDE 17

Black Hat USA 2007

Listening to your hardware - demo

Oscilloscope CPU Embedded system sensor amplifier Analysis Software I/O trigger analog signal digitized signal EM probe

slide-18
SLIDE 18

Black Hat USA 2007

Simple Power/EM Analysis

  • Recover information by inspection of single or averaged traces
  • Can also be useful for reverse engineering algorithms and

implementations

slide-19
SLIDE 19

Black Hat USA 2007

Differential Power/EM Analysis

  • Recover information by inspection difference between traces

with different (random) inputs

  • Use correlation to retrieve information from noisy signals
slide-20
SLIDE 20

Black Hat USA 2007

Data/signal correlation

slide-21
SLIDE 21

Black Hat USA 2007

Agenda

  • Advances in Embedded Systems Security

– From USB stick to game console – Current attacks – Cryptographic devices

  • Side Channels explained

– Principles – Listening to your hardware – Types of analysis

  • Attacks and Countermeasures

– Breaking a key – Countermeasures theory – Practical implementations

slide-22
SLIDE 22

Black Hat USA 2007

Secure CPUs

slide-23
SLIDE 23

Black Hat USA 2007

Breaking a key - demo

  • Example breaking a DES key with a differential attack
  • Starting a measurement
  • Explaining DES analysis
  • Showing results
slide-24
SLIDE 24

Black Hat USA 2007

DES

16 rounds

  • Input and output are 64 bits
  • Key K is 56 bits

round keys are 48 bits

  • Cipher function F mixes

input and round key

slide-25
SLIDE 25

Black Hat USA 2007

F- function

E permutation S box 1 P permutation S box 2 S box 8 Round key 32 → 48 8 * (6 → 4) 32 → 32 48

slide-26
SLIDE 26

Black Hat USA 2007

DPA on DES

  • Simulate DES algorithm based on input bits and

hypotheses k.

  • Select one S-Box, and one output bit x. Bit x

depends on only 6 key bits.

  • Calculate differential trace for the 64 different

values of k.

  • Incorrect guess will show noise, correct guess will

show peaks. E permutation S box i Round key 32 → 48 48

Bit 1 Bit 4

6

slide-27
SLIDE 27

Black Hat USA 2007

DPA on DES results

slide-28
SLIDE 28

Black Hat USA 2007

Countermeasures

  • Decrease leakage

– Balance processing of values – Limit number of operations per key

  • Increase noise

– Introduce timing variations in processing – Use hardware means

slide-29
SLIDE 29

Black Hat USA 2007

Countermeasures concepts

  • Passive Side channel attacks:

– Hiding: Break relation between processed value and power consumption – Masking / Blinding: Break relation between algorithmic value and processed value Algorithmic value Processed value Measured value (at guessed position) Masking Hiding

slide-30
SLIDE 30

Black Hat USA 2007

Countermeasure examples

  • Change the crypto protocol to use key material only for a

limited amount of operations. For instance, use short lived session keys based on a hash of an initial key. Example:

Source: Kocher, P. Design and Validation Strategies for Obtaining Assurance in Countermeasures to Power Analysis and Related Attacks

slide-31
SLIDE 31

Black Hat USA 2007

Countermeasure examples

  • Remove any execution time dependence on data and key. Do

not forget cache timing and branch prediction. Also remove conditional execution that depends on the key.

  • Randomly insert instructions with no effect on the algorithm.

Use different instructions that are hard to recognize in a trace

MOV XOR ADD INC CMP MOV NOP XOR ADD NOP INC NOP CMP MOV XOR NOP ADD INC CMP

default random random

slide-32
SLIDE 32

Black Hat USA 2007

Countermeasure examples

  • Shuffling: Changing the order of independent operations (for

instance S-box calculations) per round. This reduces correlation with a factor equal to the number of shuffled operations

  • Implement a masked version of the cryptographic algorithm.

Examples can be found in research literature for common algorithms (RSA, AES).

Sbox 1 Sbox 2 Sbox 3 Sbox 4 Sbox 5 Sbox 6 Sbox 7 Sbox 8 Sbox 4 Sbox 8 Sbox 1 Sbox 3 Sbox 6 Sbox 5 Sbox 2 Sbox 7

default random

slide-33
SLIDE 33

Black Hat USA 2007

Countermeasure demos

  • Simple analysis of unprotected trace
  • Effect of randomly inserting NOP instructions
  • Effect of making RSA square-multiply constant
slide-34
SLIDE 34

Black Hat USA 2007

1 1

Key bits revealed

1 1 1 1 0 0 1 1

key bits revealed signal processing to high-light dips variation of interval between dips

SPA attack on RSA

slide-35
SLIDE 35

Black Hat USA 2007

RSA implementations

  • Algorithm for M=cd, with di

is exponent bits (0≤i≤t)

– M := 1 – For i from t down to 0 do:

  • M := M * M
  • If di = 1, then M := M*C
  • Algorithm for M=cd, with di group of exponent bits (0≤i≤t)

– Precompute multipliers Ci – M := 1 – For i from t down to 0 do:

  • For j = 1 to groupSize: M := M * M
  • M := M* Ci
slide-36
SLIDE 36

Black Hat USA 2007

Example: RSA message blinding

  • Normal encryption: M = Cd mod n under condition:

– n = p·q – e·d = 1 mod lcm(p-1, q-1)

  • Choose a random r, then Cr = C re mod n
  • Perform RSA: Mr = Cr

d mod n = Cdr mod n

  • M = Mr r-1 mod n
  • During the RSA operation itself the operations with exponent d

do not depend on C

slide-37
SLIDE 37

Black Hat USA 2007

Test and verification

  • The best way to understand side channel leakage is to measure

your own implementation

  • Side channels analysis can be performed on a device to assess

its level of vulnerability to such attacks

  • Such analysis is part of certification processes in the payment

industry and in Common Criteria evaluations.

  • FIPS 140-3 will require side channel testing for certain levels
slide-38
SLIDE 38

Black Hat USA 2007

Countermeasure licensing

  • DPA attacks were first published by Paul Kocher et al. from

Cryptography Research, Inc. (CRI)

  • A large range of countermeasures are patented by CRI and
  • ther companies
  • CRI licenses the use of them
  • The patents give a good idea of possible countermeasures,

check with CRI

slide-39
SLIDE 39

Black Hat USA 2007

Conclusions

  • With the increase of security features in embedded devices the

importance of side channel attacks will also increase

  • Most of these devices with advanced security features do not

yet contain hardware countermeasures against side channel attacks

  • Side channel attacks present a serious threat with wide range
  • f possibilities and a large impact
  • Still, software developers can reduce the risks of side channel

attacks by securing their implementations with software countermeasures

slide-40
SLIDE 40

Black Hat USA 2007

More info

Job de Haas dehaas@riscure.com

slide-41
SLIDE 41

Black Hat USA 2007

References

1. Joe Grand, “Advanced Hardware Hacking Techniques”, Defcon 12 http://www.grandideastudio.com/files/security/hardware/advanced_hardware_hacking_techniq ues_slides.pdf 2. Josh Jaffe, “Differential Power Analysis”, Summer School on Cryptographic Hardware http://www.dice.ucl.ac.be/crypto/ecrypt-scard/jaffe.pdf http://www.dice.ucl.ac.be/crypto/ecrypt-scard/jaffe2.pdf 3.

  • S. Mangard, E. Oswald, T. Popp, “Power Analysis Attacks -

Revealing the Secrets of Smartcards” http://www.dpabook.org/ 4. Dan J. Bernstein, ''Cache-timing attacks on AES'', http://cr.yp.to/papers.html#cachetiming, 2005. 5.

  • D. Brumley, D. Boneh, “Remote Timing Attacks are Practical”

http://crypto.stanford.edu/~dabo/papers/ssl-timing.pdf 6.

  • P. Kocher, "Design and Validation Strategies for Obtaining Assurance in Countermeasures to

Power Analysis and Related Attacks", NIST Physical Security Testing Workshop - Honolulu,

  • Sept. 26, 2005

http://csrc.nist.gov/cryptval/physec/papers/physecpaper09.pdf 7.

  • E. Oswald, K. Schramm, “An Efficient Masking Scheme for AES Software Implementations”

www.iaik.tugraz.at/research/sca-lab/publications/pdf/Oswald2006AnEfficientMasking.pdf 8. Cryptography Research, Inc. Patents and Licensing http://www.cryptography.com/technology/dpa/licensing.html