TEMPEST Attacks Against AES Covertly stealing keys for $200 Craig - - PowerPoint PPT Presentation

▶
tempest attacks against aes
SMART_READER_LITE
LIVE PREVIEW

TEMPEST Attacks Against AES Covertly stealing keys for $200 Craig - - PowerPoint PPT Presentation

Feb 19, 2023 181 likes •1.3k views

TEMPEST Attacks Against AES Covertly stealing keys for $200 Craig Ramsay & Jasper Lohuis September 22, 2017 Introduction Your code just pushes electrons around. 0010101 10 10101010010101 Pushing electrons will make magnetic fjelds.

slide-1
SLIDE 1

TEMPEST Attacks Against AES

Covertly stealing keys for $200

Craig Ramsay & Jasper Lohuis September 22, 2017

slide-2
SLIDE 2

Introduction

slide-3
SLIDE 3

10101010010101 0010101 10

Your code just pushes electrons around.

slide-4
SLIDE 4

10101010010101 0010101 10

Pushing electrons will make magnetic fjelds.

slide-5
SLIDE 5

10101010010101 0010101 10

TEMPEST attacks measure this from a distance.

slide-6
SLIDE 6

10101010010101 0010101 10

TEMPEST attacks measure this from a distance.

slide-7
SLIDE 7

Project people

Duncan Lew First intern. Close-by FPGA attacks Freek van Tienen We’ll see! Craig Ramsay Radio-based workfmow & attacking ARM Jasper Lohuis Cheap shielding, SDRs & antennas

slide-8
SLIDE 8

Thanks for feeding us, folks

slide-9
SLIDE 9

Existing Work

TEMPEST attack On-package attack Asymmetric crypto Symmetric crypto Us! Possible? With what resources? Are existing norms enough?

slide-10
SLIDE 10

Existing Work

TEMPEST attack On-package attack Asymmetric crypto Symmetric crypto Us! Possible? With what resources? Are existing norms enough?

slide-11
SLIDE 11

Existing Work

TEMPEST attack On-package attack Asymmetric crypto Symmetric crypto Us! Possible? With what resources? Are existing norms enough?

slide-12
SLIDE 12

Existing Work

TEMPEST attack On-package attack Asymmetric crypto Symmetric crypto Us! Possible? With what resources? Are existing norms enough?

slide-13
SLIDE 13

Replicating On-Package Attack

slide-14
SLIDE 14

Target Device Analogue Measurement Radio Recording Preprocessing Analysis

Overview

slide-15
SLIDE 15

Target Device Analogue Measurement Radio Recording Preprocessing Analysis Target Device

Overview

slide-16
SLIDE 16

Target Device Analogue Measurement Radio Recording Preprocessing Analysis Target Device E n c r y p t t h i s , p l e a s e . . .

Overview

slide-17
SLIDE 17

Target Device Analogue Measurement Radio Recording Preprocessing Analysis Target Device E n c r y p t t h i s , p l e a s e . . . A l s t u . . .

Overview

slide-18
SLIDE 18

Target Device Analogue Measurement Radio Recording Preprocessing Analysis Analogue Measurement

Overview

slide-19
SLIDE 19

Target Device Analogue Measurement Radio Recording Preprocessing Analysis Radio Recording Radio Recording Mixer ADC 001010111101101

Overview

slide-20
SLIDE 20

Target Device Analogue Measurement Radio Recording Preprocessing Analysis Preprocessing

Overview

slide-21
SLIDE 21

Target Device Analogue Measurement Radio Recording Preprocessing Analysis Analysis Model of leakage

Overview

slide-22
SLIDE 22

Measuring the fjeld

slide-23
SLIDE 23

Measuring the fjeld

slide-24
SLIDE 24

Recording —Low-end

slide-25
SLIDE 25

Recording —Low-end

€20 2.4 MHz Bandwidth 5.2 MB/s

slide-26
SLIDE 26

Positioning

slide-27
SLIDE 27

Positioning

slide-28
SLIDE 28

ARM Software Trace

0.2 0.4 0.6 0.8 1 1.2 1.4 1.6 1.8 2 ·10−4 6 7 8 9 ·103

Idle I/O Key Schedule 14 Rounds I/O Idle t

slide-29
SLIDE 29

ARM Software Trace

0.2 0.4 0.6 0.8 1 1.2 1.4 1.6 1.8 2 ·10−4 6 7 8 9 ·103

Idle I/O Key Schedule 14 Rounds I/O Idle t

slide-30
SLIDE 30

ARM Software Trace

0.2 0.4 0.6 0.8 1 1.2 1.4 1.6 1.8 2 ·10−4 6 7 8 9 ·103

Idle I/O Key Schedule 14 Rounds I/O Idle t

slide-31
SLIDE 31

ARM Software Trace

0.2 0.4 0.6 0.8 1 1.2 1.4 1.6 1.8 2 ·10−4 6 7 8 9 ·103

Idle I/O Key Schedule 14 Rounds I/O Idle t

slide-32
SLIDE 32

ARM Software Trace

0.2 0.4 0.6 0.8 1 1.2 1.4 1.6 1.8 2 ·10−4 6 7 8 9 ·103

Idle I/O Key Schedule 14 Rounds I/O Idle t

slide-33
SLIDE 33

Nice… but still, how do you get a key?

(This part is just existing SCA techniques)

slide-34
SLIDE 34

Our trace is related to “power consumption”.

slide-35
SLIDE 35

P ≈ Pstatic + Pnoise + Pdata + Poperation

slide-36
SLIDE 36

P ≈ Pstatic + Pnoise + Pdata + Poperation

slide-37
SLIDE 37

Correlation Intro

4 1 6 (# ‘1’ bits) Power estimate 0011 0101 0100 0000 1101 1110 Input Byte Correlate!

slide-38
SLIDE 38

Correlation Intro

4 1 6 (# ‘1’ bits) Power estimate 0011 0101 0100 0000 1101 1110 Input Byte Correlate!

slide-39
SLIDE 39

Correlation Intro

4 1 6 (# ‘1’ bits) Power estimate 0011 0101 0100 0000 1101 1110 Input Byte Correlate!

slide-40
SLIDE 40

Correlation Intro

4 1 6 (# ‘1’ bits) Power estimate 0011 0101 0100 0000 1101 1110 Input Byte Correlate!

slide-41
SLIDE 41

Correlation Intro

4 1 6 (# ‘1’ bits) Power estimate 0011 0101 0100 0000 1101 1110 Input Byte Correlate!

slide-42
SLIDE 42

Correlation Intro

4 1 6 (# ‘1’ bits) Power estimate 0011 0101 0100 0000 1101 1110 Input Byte Correlate!

slide-43
SLIDE 43

I/O Correlation

slide-44
SLIDE 44

We can detect data!

slide-45
SLIDE 45

Let’s fjnd a value using 1 key byte and correlate for all 256 possibilities

slide-46
SLIDE 46

32 × 28 guesses (instead of 2256)

slide-47
SLIDE 47

8192 guesses (instead of 1077)

slide-48
SLIDE 48

T Table Correlation

Easy & works (but could do better)

Known-key bitwise on T Table lookup

slide-49
SLIDE 49

T Table Correlation

Easy & works (but could do better)

Known-key bitwise on T Table lookup

slide-50
SLIDE 50

“You know can addresses leak too, right?” —Riscure, 2017

slide-51
SLIDE 51

“Oh… thanks.” — Me, 2017

slide-52
SLIDE 52

ARM T Table Addresses

1508: 4b4a ldr r3 , [ pc , #296] 150a : 681b ldr r3 , [ r3 , #0] 150 c : 0e1b l s r s r3 , r3 , #24 150e : 4a4d ldr r2 , [ pc , \#308] 1510: f852 2023 ldr.w r2, [r2, r3, lsl #2] 1 5 1 4 : 4b48 ldr r3 , [ pc , #288] 1 5 1 6 : 681b ldr r3 , [ r3 , #0] 1518 : 0c1b l s r s r3 , r3 , #16 151a b2db uxtb r3 , r3 151c : 494a ldr r1 , [ pc , #296]

slide-53
SLIDE 53

T Table Address Correlation

Known-key bitwise on T Table lookup address ⊕ previous address

slide-54
SLIDE 54

If the correlation for the correct key byte is biggest, we have an attack.

slide-55
SLIDE 55

T Table Attack

Correct key byte…

HD on T Table lookup address (real attack)

slide-56
SLIDE 56

T Table Attack

All key byte guesses. We win!

HD on T Table lookup address (real attack)

slide-57
SLIDE 57

Repeat this for all 32 key bytes and we have the full key

slide-58
SLIDE 58

On-package attack results

slide-59
SLIDE 59

Bandwidth vs # traces

1 2 3 4 5 6 7 8 9 10 2 4 6 8 10 ·104

2.4 fclk = 140 MHz Bandwidth / MHz

Traces

slide-60
SLIDE 60

Bandwidth vs # traces

1 2 3 4 5 6 7 8 9 10 2 4 6 8 10 ·104

2.4 fclk = 140 MHz Bandwidth / MHz

Traces

slide-61
SLIDE 61

Bandwidth vs # traces

1 2 3 4 5 6 7 8 9 10 2 4 6 8 10 ·104

€20 Equipment cost

Time

slide-62
SLIDE 62

Getting some distance

slide-63
SLIDE 63

Only need to improve analogue side. Analysis is the same.

slide-64
SLIDE 64

Loop size

slide-65
SLIDE 65

Loop size

slide-66
SLIDE 66

Amplifjcation and fjltering

slide-67
SLIDE 67

Small loop distance

2 4 6 8 10 12 14 16 18 20 −30 −25 −20 −15 −10 −5

d / cm Power / dB

slide-68
SLIDE 68

Demo time

(Click for video)

slide-69
SLIDE 69

Small loops are amazing for under ≈ 5 cm. Won’t get us to 1 m though.

slide-70
SLIDE 70

Log-periodic antenna

slide-71
SLIDE 71

Log-periodic distance

5 10 15 20 25 30 35 −20 −15 −10 −5

d / cm Power / dB

slide-72
SLIDE 72

Example setup

slide-73
SLIDE 73

DIY shielding

slide-74
SLIDE 74

Real setup

slide-75
SLIDE 75

Best setup so far: Key from 30 cm away 400k traces ( 50 s recording) 200 equipment

slide-76
SLIDE 76

Best setup so far: Key from 30 cm away 400k traces (≈ 50 s recording) 200 equipment

slide-77
SLIDE 77

Best setup so far: Key from 30 cm away 400k traces (≈ 50 s recording) ≈ $200 equipment

slide-78
SLIDE 78

…and in ideal conditions? (Thanks, OSPL)

slide-79
SLIDE 79

Anechoic Chamber

slide-80
SLIDE 80

Electrical isolation?

slide-81
SLIDE 81

Key from 1 m away 2 4 M traces ( 5 mins recording) Same 200 setup + borrowed antenna

slide-82
SLIDE 82

Key from 1 m away 2.4 M traces (≈ 5 mins recording) Same 200 setup + borrowed antenna

slide-83
SLIDE 83

Key from 1 m away 2.4 M traces (≈ 5 mins recording) Same $200 setup + borrowed antenna

slide-84
SLIDE 84

Conclusion

slide-85
SLIDE 85

Conclusion

  • Break OpenSSL’s AES with a wire and a $20 dongle
  • Radio hardware → really speeds up attack
  • Increase attack distance with new analogue

front-ends

  • First known demonstration
  • 1 m works in 5 minutes…
slide-86
SLIDE 86

Thanks! Questions?

slide-87
SLIDE 87

Backup slides

slide-88
SLIDE 88

Selecting an intermediate

slide-89
SLIDE 89

a0,0 a0,1 a0,2 a0,3 a1,0 a1,1 a1,2 a1,3 a2,0 a2,1 a2,2 a2,3 a3,0 a3,1 a3,2 a3,3 b0,0 b0,1 b0,2 b0,3 b1,0 b1,1 b1,2 b1,3 b2,0 b2,1 b2,2 b2,3 b3,0 b3,1 b3,2 b3,3 Round 0 Key

OpenSSL AES Round 0

slide-90
SLIDE 90

a0,0 a0,1 a0,2 a0,3 a1,0 a1,1 a1,2 a1,3 a2,0 a2,1 a2,2 a2,3 a3,0 a3,1 a3,2 a3,3 b0,0 b0,1 b0,2 b0,3 b1,0 b1,1 b1,2 b1,3 b2,0 b2,1 b2,2 b2,3 b3,0 b3,1 b3,2 b3,3 Round 0 Key Attack XOR with key? ...Can do better!

OpenSSL AES Round 0

slide-91
SLIDE 91

b0,0 b0,1 b0,2 b0,3 b1,0 b1,1 b1,2 b1,3 b2,0 b2,1 b2,2 b2,3 b3,0 b3,1 b3,2 b3,3 b0,0 b0,1 b0,2 b0,3 b1,0 b1,1 b1,2 b1,3 b2,0 b2,1 b2,2 b2,3 b3,0 b3,1 b3,2 b3,3 c0,0 c0,1 c0,2 c0,3 c1,0 c1,1 c1,2 c1,3 c2,0 c2,1 c2,2 c2,3 c3,0 c3,1 c3,2 c3,3 T0(...) T1(...) T2(...) T3(...) Round 1 Key

OpenSSL AES Round 1

slide-92
SLIDE 92

b0,0 b0,1 b0,2 b0,3 b1,0 b1,1 b1,2 b1,3 b2,0 b2,1 b2,2 b2,3 b3,0 b3,1 b3,2 b3,3 b0,0 b0,1 b0,2 b0,3 b1,0 b1,1 b1,2 b1,3 b2,0 b2,1 b2,2 b2,3 b3,0 b3,1 b3,2 b3,3 c0,0 c0,1 c0,2 c0,3 c1,0 c1,1 c1,2 c1,3 c2,0 c2,1 c2,2 c2,3 c3,0 c3,1 c3,2 c3,3 T0(...) T1(...) T2(...) T3(...) Round 1 Key

OpenSSL AES Round 1

slide-93
SLIDE 93

b0,0 b0,1 b0,2 b0,3 b1,0 b1,1 b1,2 b1,3 b2,0 b2,1 b2,2 b2,3 b3,0 b3,1 b3,2 b3,3 b0,0 b0,1 b0,2 b0,3 b1,0 b1,1 b1,2 b1,3 b2,0 b2,1 b2,2 b2,3 b3,0 b3,1 b3,2 b3,3 c0,0 c0,1 c0,2 c0,3 c1,0 c1,1 c1,2 c1,3 c2,0 c2,1 c2,2 c2,3 c3,0 c3,1 c3,2 c3,3 T0(...) T1(...) T2(...) T3(...) Round 1 Key

OpenSSL AES Round 1

slide-94
SLIDE 94

b0,0 b0,1 b0,2 b0,3 b1,0 b1,1 b1,2 b1,3 b2,0 b2,1 b2,2 b2,3 b3,0 b3,1 b3,2 b3,3 b0,0 b0,1 b0,2 b0,3 b1,0 b1,1 b1,2 b1,3 b2,0 b2,1 b2,2 b2,3 b3,0 b3,1 b3,2 b3,3 c0,0 c0,1 c0,2 c0,3 c1,0 c1,1 c1,2 c1,3 c2,0 c2,1 c2,2 c2,3 c3,0 c3,1 c3,2 c3,3 T0(...) T1(...) T2(...) T3(...) Round 1 Key

OpenSSL AES Round 1

slide-95
SLIDE 95

b0,0 b0,1 b0,2 b0,3 b1,0 b1,1 b1,2 b1,3 b2,0 b2,1 b2,2 b2,3 b3,0 b3,1 b3,2 b3,3 b0,0 b0,1 b0,2 b0,3 b1,0 b1,1 b1,2 b1,3 b2,0 b2,1 b2,2 b2,3 b3,0 b3,1 b3,2 b3,3 c0,0 c0,1 c0,2 c0,3 c1,0 c1,1 c1,2 c1,3 c2,0 c2,1 c2,2 c2,3 c3,0 c3,1 c3,2 c3,3 T0(...) T1(...) T2(...) T3(...) Round 1 Key Attack these lookups. The non-linearity is useful.

OpenSSL AES Round 1

slide-96
SLIDE 96

Our setup vs traditional setup

slide-97
SLIDE 97

Recording comparison — ’Scope

slide-98
SLIDE 98

Arm

Recording comparison — ’Scope

slide-99
SLIDE 99

Send 1 command

Recording comparison — ’Scope

slide-100
SLIDE 100

Trigger

Recording comparison — ’Scope

slide-101
SLIDE 101

Record

Recording comparison — ’Scope

slide-102
SLIDE 102

Copy

Recording comparison — ’Scope

slide-103
SLIDE 103

Recording comparison — ’Scope fclk

f

fs 2fclk

slide-104
SLIDE 104

Recording comparison — ’Scope fclk

f

fs > 2fclk

slide-105
SLIDE 105

Recording comparison — Radio

×e−j2πfclkt

BW fclk

f

fs 2 BW

slide-106
SLIDE 106

Recording comparison — Radio

×e−j2πfclkt

BW fclk

f

fs 2 BW

slide-107
SLIDE 107

Recording comparison — Radio

×e−j2πfclkt

BW fclk

f

fs 2 BW

slide-108
SLIDE 108

Recording comparison — Radio

×e−j2πfclkt

BW fclk

f

fs > 2 × BW

slide-109
SLIDE 109

Recording comparison — Radio

slide-110
SLIDE 110

Record continuously

Recording comparison — Radio

slide-111
SLIDE 111

Record continuously Send commands

Recording comparison — Radio