Embed Size (px)
Citation preview
Hardware Security
Probing attacks
R. [email protected] 21, 2020
...
.
.................................
..
.
...
.
Outline
On-chip attacksInvestigation techniquesOn-chip probing attacksCountermeasures against on-chip probingExamples of on-chip probing
On-board probing attacksIntroductionCode encipheringCode and data encipheringIntegrity
Conclusion: a Trusted Computing Platform (TCP)
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.2/88 Institut Mines-Telecom R. Pacalet April 21, 2020
On-chip attacks
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.3/88 Institut Mines-Telecom R. Pacalet April 21, 2020
On-chip attacks / Investigation techniques
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.4/88 Institut Mines-Telecom R. Pacalet April 21, 2020
On-chip ⇒de-packaging
Attacks on silicon are usually expensive but not that much...• De-packaging (mechanical, chemical actions) without damaging the device• Re-connecting in a new package
Source: Oliver Kömmerling, Marcus Kuhn
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.5/88 Institut Mines-Telecom R. Pacalet April 21, 2020
On-chip ⇒de-packaging
Attacks on silicon are usually expensive but not that much...• De-packaging (mechanical, chemical actions) without damaging the device• Re-connecting in a new package
Source: Oliver Kömmerling, Marcus Kuhn
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.5/88 Institut Mines-Telecom R. Pacalet April 21, 2020
On-chip ⇒de-packaging
Attacks on silicon are usually expensive but not that much...• De-packaging (mechanical, chemical actions) without damaging the device• Re-connecting in a new package
Source: Oliver Kömmerling, Marcus Kuhn
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.5/88 Institut Mines-Telecom R. Pacalet April 21, 2020
On-chip ⇒de-packaging
Attacks on silicon are usually expensive but not that much...• De-packaging (mechanical, chemical actions) without damaging the device• Re-connecting in a new package
Source: Oliver Kömmerling, Marcus Kuhn
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.5/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Reverse engineering
Layout reconstruction (microscope + time and skill)Removal of metal layers (HF acid) necessary to reconstruct deep layers
The vias in this structure form a permutation matrix between thememory readout column lines and the 16:1 demultiplexer. The
applied mapping remains clearly visible.
Left: CMOS AND gate imaged by a confocal microscope. Right:same gate after removal of metal layer (HF wet etching).
Polysilicon interconnects and diffusion areas are now fullyvisible.
Source: Oliver Kömmerling, Marcus Kuhn
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.6/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Reverse engineering
Layout reconstruction (microscope + time and skill)Removal of metal layers (HF acid) necessary to reconstruct deep layers
The vias in this structure form a permutation matrix between thememory readout column lines and the 16:1 demultiplexer. The
applied mapping remains clearly visible.
Left: CMOS AND gate imaged by a confocal microscope. Right:same gate after removal of metal layer (HF wet etching).
Polysilicon interconnects and diffusion areas are now fullyvisible.
Source: Oliver Kömmerling, Marcus Kuhn
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.6/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Reverse engineering
Layout reconstruction (microscope + time and skill)Removal of metal layers (HF acid) necessary to reconstruct deep layers
The vias in this structure form a permutation matrix between thememory readout column lines and the 16:1 demultiplexer. The
applied mapping remains clearly visible.
Left: CMOS AND gate imaged by a confocal microscope. Right:same gate after removal of metal layer (HF wet etching).
Polysilicon interconnects and diffusion areas are now fullyvisible.
Source: Oliver Kömmerling, Marcus Kuhn
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.6/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Reverse engineering
Layout reconstruction (microscope + time and skill)Removal of metal layers (HF acid) necessary to reconstruct deep layers
The vias in this structure form a permutation matrix between thememory readout column lines and the 16:1 demultiplexer. The
applied mapping remains clearly visible.
Left: CMOS AND gate imaged by a confocal microscope. Right:same gate after removal of metal layer (HF wet etching).
Polysilicon interconnects and diffusion areas are now fullyvisible.
Source: Oliver Kömmerling, Marcus Kuhn
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.6/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Memory content recovery
ROM content reconstruction techniques
16x10 bits NOR ROM. Every bit is represented by either apresent or missing diffusion layer connection.
Source: Oliver Kömmerling, Marcus Kuhn
Implant-mask layout of a NAND ROM, made visible by adopant-selective crystallographic etch. 16×14 bits plus parts
of the row selector of a ROM. The threshold voltage of 0-bitP-channel transistors (stained dark here) was brought below 0 V
through ion implantation.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.7/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Memory content recovery
ROM content reconstruction techniques
16x10 bits NOR ROM. Every bit is represented by either apresent or missing diffusion layer connection.
Source: Oliver Kömmerling, Marcus Kuhn
Implant-mask layout of a NAND ROM, made visible by adopant-selective crystallographic etch. 16×14 bits plus parts
of the row selector of a ROM. The threshold voltage of 0-bitP-channel transistors (stained dark here) was brought below 0 V
through ion implantation.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.7/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Memory content recovery
ROM content reconstruction techniques
16x10 bits NOR ROM. Every bit is represented by either apresent or missing diffusion layer connection.
Source: Oliver Kömmerling, Marcus Kuhn
Implant-mask layout of a NAND ROM, made visible by adopant-selective crystallographic etch. 16×14 bits plus parts
of the row selector of a ROM. The threshold voltage of 0-bitP-channel transistors (stained dark here) was brought below 0 V
through ion implantation.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.7/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Memory content recovery
ROM content reconstruction techniques
16x10 bits NOR ROM. Every bit is represented by either apresent or missing diffusion layer connection.
Source: Oliver Kömmerling, Marcus Kuhn
Implant-mask layout of a NAND ROM, made visible by adopant-selective crystallographic etch. 16×14 bits plus parts
of the row selector of a ROM. The threshold voltage of 0-bitP-channel transistors (stained dark here) was brought below 0 V
through ion implantation.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.7/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Memory content recovery
RAM content reconstruction techniquesRed low power laser beams ionize active areas
• Power off imaging identifies active areas• Power on imaging distinguishes closed and opened transistor channels
Power off
Source: Samyde, Skorobogatov, Anderson and Quisquater
Power on. SRAM content:1 1 0 01 1 1 01 1 1 11 1 1 1
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.8/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Memory content recovery
RAM content reconstruction techniquesRed low power laser beams ionize active areas
• Power off imaging identifies active areas• Power on imaging distinguishes closed and opened transistor channels
Power off
Source: Samyde, Skorobogatov, Anderson and Quisquater
Power on. SRAM content:1 1 0 01 1 1 01 1 1 11 1 1 1
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.8/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Memory content recovery
RAM content reconstruction techniquesRed low power laser beams ionize active areas
• Power off imaging identifies active areas• Power on imaging distinguishes closed and opened transistor channels
Power off
Source: Samyde, Skorobogatov, Anderson and Quisquater
Power on. SRAM content:1 1 0 01 1 1 01 1 1 11 1 1 1
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.8/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Memory content recovery
RAM content reconstruction techniquesRed low power laser beams ionize active areas
• Power off imaging identifies active areas• Power on imaging distinguishes closed and opened transistor channels
Power off
Source: Samyde, Skorobogatov, Anderson and Quisquater
Power on. SRAM content:1 1 0 01 1 1 01 1 1 11 1 1 1
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.8/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Memory content recovery
RAM content reconstruction techniquesRed low power laser beams ionize active areas
• Power off imaging identifies active areas• Power on imaging distinguishes closed and opened transistor channels
Power off
Source: Samyde, Skorobogatov, Anderson and Quisquater
Power on. SRAM content:1 1 0 01 1 1 01 1 1 11 1 1 1
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.8/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Memory content recovery
Electromagnetic investigation• Use of a miniature inductor wrapped around a microprobe needle• Induce eddy currents in silicon and sense them to build a map• Alternatively induce very small perturbations and observe different behaviour for 0 and 1
A picture and a map of the same area built usingeddy current
Source: Samyde, Skorobogatov, Anderson and Quisquater
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.9/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Memory content recovery
Electromagnetic investigation• Use of a miniature inductor wrapped around a microprobe needle• Induce eddy currents in silicon and sense them to build a map• Alternatively induce very small perturbations and observe different behaviour for 0 and 1
A picture and a map of the same area built usingeddy current
Source: Samyde, Skorobogatov, Anderson and Quisquater
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.9/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Memory content recovery
Electromagnetic investigation• Use of a miniature inductor wrapped around a microprobe needle• Induce eddy currents in silicon and sense them to build a map• Alternatively induce very small perturbations and observe different behaviour for 0 and 1
A picture and a map of the same area built usingeddy current
Source: Samyde, Skorobogatov, Anderson and Quisquater
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.9/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Memory content recovery
Electromagnetic investigation• Use of a miniature inductor wrapped around a microprobe needle• Induce eddy currents in silicon and sense them to build a map• Alternatively induce very small perturbations and observe different behaviour for 0 and 1
A picture and a map of the same area built usingeddy current
Source: Samyde, Skorobogatov, Anderson and Quisquater
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.9/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Memory content recovery
Electromagnetic investigation• Use of a miniature inductor wrapped around a microprobe needle• Induce eddy currents in silicon and sense them to build a map• Alternatively induce very small perturbations and observe different behaviour for 0 and 1
A picture and a map of the same area built usingeddy current
Source: Samyde, Skorobogatov, Anderson and Quisquater
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.9/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Memory content recovery
Laser or electromagnetic investigation is slow• Suitable when freezing the chip is an option• Secured devices sometimes prevent this with low clock frequency detectors• Freezing a static RAM when power is off allows to maintain the initial content for minutes
or hours
Lest We Remember: Cold Boot Attacks on Encryption Keys
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.10/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Memory content recovery
Laser or electromagnetic investigation is slow• Suitable when freezing the chip is an option• Secured devices sometimes prevent this with low clock frequency detectors• Freezing a static RAM when power is off allows to maintain the initial content for minutes
or hours
Lest We Remember: Cold Boot Attacks on Encryption Keys
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.10/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Memory content recovery
Laser or electromagnetic investigation is slow• Suitable when freezing the chip is an option• Secured devices sometimes prevent this with low clock frequency detectors• Freezing a static RAM when power is off allows to maintain the initial content for minutes
or hours
Lest We Remember: Cold Boot Attacks on Encryption Keys
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.10/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Memory content recovery
Laser or electromagnetic investigation is slow• Suitable when freezing the chip is an option• Secured devices sometimes prevent this with low clock frequency detectors• Freezing a static RAM when power is off allows to maintain the initial content for minutes
or hours
Lest We Remember: Cold Boot Attacks on Encryption Keys
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.10/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Memory content recovery
Laser or electromagnetic investigation is slow• Suitable when freezing the chip is an option• Secured devices sometimes prevent this with low clock frequency detectors• Freezing a static RAM when power is off allows to maintain the initial content for minutes
or hours
Lest We Remember: Cold Boot Attacks on Encryption Keys
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.10/88 Institut Mines-Telecom R. Pacalet April 21, 2020
On-chip attacks / On-chip probing attacks
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.11/88 Institut Mines-Telecom R. Pacalet April 21, 2020
On-chip probing
Laser attack passivationlayersMicroscope (UV for deepsub-micron process)Micropositioner(sub-micron)Microprobe (< 100 nm)connected to DSP card
Source: Oliver Kömmerling, Marcus Kuhn
9 horizontal bus lines on a depackaged smartcard processor. AUV laser (355 nm, 5 ns) was used to remove small patches of
the passivation layer over the eight data-bus lines to provide formicroprobing access.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.12/88 Institut Mines-Telecom R. Pacalet April 21, 2020
On-chip probing
Laser attack passivationlayersMicroscope (UV for deepsub-micron process)Micropositioner(sub-micron)Microprobe (< 100 nm)connected to DSP card
Source: Oliver Kömmerling, Marcus Kuhn
9 horizontal bus lines on a depackaged smartcard processor. AUV laser (355 nm, 5 ns) was used to remove small patches of
the passivation layer over the eight data-bus lines to provide formicroprobing access.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.12/88 Institut Mines-Telecom R. Pacalet April 21, 2020
On-chip probing
Laser attack passivationlayersMicroscope (UV for deepsub-micron process)Micropositioner(sub-micron)Microprobe (< 100 nm)connected to DSP card
Source: Oliver Kömmerling, Marcus Kuhn
9 horizontal bus lines on a depackaged smartcard processor. AUV laser (355 nm, 5 ns) was used to remove small patches of
the passivation layer over the eight data-bus lines to provide formicroprobing access.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.12/88 Institut Mines-Telecom R. Pacalet April 21, 2020
On-chip probing
Laser attack passivationlayersMicroscope (UV for deepsub-micron process)Micropositioner(sub-micron)Microprobe (< 100 nm)connected to DSP card
Source: Oliver Kömmerling, Marcus Kuhn
9 horizontal bus lines on a depackaged smartcard processor. AUV laser (355 nm, 5 ns) was used to remove small patches of
the passivation layer over the eight data-bus lines to provide formicroprobing access.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.12/88 Institut Mines-Telecom R. Pacalet April 21, 2020
On-chip probing
Laser attack passivationlayersMicroscope (UV for deepsub-micron process)Micropositioner(sub-micron)Microprobe (< 100 nm)connected to DSP card
Source: Oliver Kömmerling, Marcus Kuhn
9 horizontal bus lines on a depackaged smartcard processor. AUV laser (355 nm, 5 ns) was used to remove small patches of
the passivation layer over the eight data-bus lines to provide formicroprobing access.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.12/88 Institut Mines-Telecom R. Pacalet April 21, 2020
On-chip probing
Laser attack passivationlayersMicroscope (UV for deepsub-micron process)Micropositioner(sub-micron)Microprobe (< 100 nm)connected to DSP card
Source: Oliver Kömmerling, Marcus Kuhn
9 horizontal bus lines on a depackaged smartcard processor. AUV laser (355 nm, 5 ns) was used to remove small patches of
the passivation layer over the eight data-bus lines to provide formicroprobing access.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.12/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Memory Read-out
Direct drive and record usually not practical (too many probes)Attacked chip drives address bus
• Some implementation prevent access to all memory locations (periodically switch betweenmultiple keys)
• Simple modifications of decoding logic can prevent branches and jumps
Probe some data bus linesReplay same sequence and change probed bus lines
• Replay can be prevented by randomization
Simplified by naïve memory integrity checking after reset
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.13/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Memory Read-out
Direct drive and record usually not practical (too many probes)Attacked chip drives address bus
• Some implementation prevent access to all memory locations (periodically switch betweenmultiple keys)
• Simple modifications of decoding logic can prevent branches and jumps
Probe some data bus linesReplay same sequence and change probed bus lines
• Replay can be prevented by randomization
Simplified by naïve memory integrity checking after reset
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.13/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Memory Read-out
Direct drive and record usually not practical (too many probes)Attacked chip drives address bus
• Some implementation prevent access to all memory locations (periodically switch betweenmultiple keys)
• Simple modifications of decoding logic can prevent branches and jumps
Probe some data bus linesReplay same sequence and change probed bus lines
• Replay can be prevented by randomization
Simplified by naïve memory integrity checking after reset
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.13/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Memory Read-out
Direct drive and record usually not practical (too many probes)Attacked chip drives address bus
• Some implementation prevent access to all memory locations (periodically switch betweenmultiple keys)
• Simple modifications of decoding logic can prevent branches and jumps
Probe some data bus linesReplay same sequence and change probed bus lines
• Replay can be prevented by randomization
Simplified by naïve memory integrity checking after reset
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.13/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Memory Read-out
Direct drive and record usually not practical (too many probes)Attacked chip drives address bus
• Some implementation prevent access to all memory locations (periodically switch betweenmultiple keys)
• Simple modifications of decoding logic can prevent branches and jumps
Probe some data bus linesReplay same sequence and change probed bus lines
• Replay can be prevented by randomization
Simplified by naïve memory integrity checking after reset
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.13/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Memory Read-out
Direct drive and record usually not practical (too many probes)Attacked chip drives address bus
• Some implementation prevent access to all memory locations (periodically switch betweenmultiple keys)
• Simple modifications of decoding logic can prevent branches and jumps
Probe some data bus linesReplay same sequence and change probed bus lines
• Replay can be prevented by randomization
Simplified by naïve memory integrity checking after reset
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.13/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Memory Read-out
Direct drive and record usually not practical (too many probes)Attacked chip drives address bus
• Some implementation prevent access to all memory locations (periodically switch betweenmultiple keys)
• Simple modifications of decoding logic can prevent branches and jumps
Probe some data bus linesReplay same sequence and change probed bus lines
• Replay can be prevented by randomization
Simplified by naïve memory integrity checking after reset
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.13/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Memory Read-out
Direct drive and record usually not practical (too many probes)Attacked chip drives address bus
• Some implementation prevent access to all memory locations (periodically switch betweenmultiple keys)
• Simple modifications of decoding logic can prevent branches and jumps
Probe some data bus linesReplay same sequence and change probed bus lines
• Replay can be prevented by randomization
Simplified by naïve memory integrity checking after reset
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.13/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Deep sub-micron ⇒new tools
Probing attacks become very expensiveFocused Ion Beam (FIB)
• 5 to 10 nm diameter• Beam currents from 1 pA to 10 nA• Very high resolution imaging• Material removal with very high precision• Combined with gas injectors material deposition (platinum or insulator)• Create new pads
– Drill a hole to a metal line– Fill with platinum– Create pad on surface for easy access
• Cost : from 500 k-euros to several M-euros• FIB time can be rented at much lower cost• Can be used to repair the test circuitry (fused after manufacturing and test) and dump
memory (more on this later)
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.14/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Deep sub-micron ⇒new tools
Probing attacks become very expensiveFocused Ion Beam (FIB)
• 5 to 10 nm diameter• Beam currents from 1 pA to 10 nA• Very high resolution imaging• Material removal with very high precision• Combined with gas injectors material deposition (platinum or insulator)• Create new pads
– Drill a hole to a metal line– Fill with platinum– Create pad on surface for easy access
• Cost : from 500 k-euros to several M-euros• FIB time can be rented at much lower cost• Can be used to repair the test circuitry (fused after manufacturing and test) and dump
memory (more on this later)
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.14/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Deep sub-micron ⇒new tools
Probing attacks become very expensiveFocused Ion Beam (FIB)
• 5 to 10 nm diameter• Beam currents from 1 pA to 10 nA• Very high resolution imaging• Material removal with very high precision• Combined with gas injectors material deposition (platinum or insulator)• Create new pads
– Drill a hole to a metal line– Fill with platinum– Create pad on surface for easy access
• Cost : from 500 k-euros to several M-euros• FIB time can be rented at much lower cost• Can be used to repair the test circuitry (fused after manufacturing and test) and dump
memory (more on this later)
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.14/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Deep sub-micron ⇒new tools
Probing attacks become very expensiveFocused Ion Beam (FIB)
• 5 to 10 nm diameter• Beam currents from 1 pA to 10 nA• Very high resolution imaging• Material removal with very high precision• Combined with gas injectors material deposition (platinum or insulator)• Create new pads
– Drill a hole to a metal line– Fill with platinum– Create pad on surface for easy access
• Cost : from 500 k-euros to several M-euros• FIB time can be rented at much lower cost• Can be used to repair the test circuitry (fused after manufacturing and test) and dump
memory (more on this later)
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.14/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Deep sub-micron ⇒new tools
Probing attacks become very expensiveFocused Ion Beam (FIB)
• 5 to 10 nm diameter• Beam currents from 1 pA to 10 nA• Very high resolution imaging• Material removal with very high precision• Combined with gas injectors material deposition (platinum or insulator)• Create new pads
– Drill a hole to a metal line– Fill with platinum– Create pad on surface for easy access
• Cost : from 500 k-euros to several M-euros• FIB time can be rented at much lower cost• Can be used to repair the test circuitry (fused after manufacturing and test) and dump
memory (more on this later)
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.14/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Deep sub-micron ⇒new tools
Probing attacks become very expensiveFocused Ion Beam (FIB)
• 5 to 10 nm diameter• Beam currents from 1 pA to 10 nA• Very high resolution imaging• Material removal with very high precision• Combined with gas injectors material deposition (platinum or insulator)• Create new pads
– Drill a hole to a metal line– Fill with platinum– Create pad on surface for easy access
• Cost : from 500 k-euros to several M-euros• FIB time can be rented at much lower cost• Can be used to repair the test circuitry (fused after manufacturing and test) and dump
memory (more on this later)
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.14/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Deep sub-micron ⇒new tools
Probing attacks become very expensiveFocused Ion Beam (FIB)
• 5 to 10 nm diameter• Beam currents from 1 pA to 10 nA• Very high resolution imaging• Material removal with very high precision• Combined with gas injectors material deposition (platinum or insulator)• Create new pads
– Drill a hole to a metal line– Fill with platinum– Create pad on surface for easy access
• Cost : from 500 k-euros to several M-euros• FIB time can be rented at much lower cost• Can be used to repair the test circuitry (fused after manufacturing and test) and dump
memory (more on this later)
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.14/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Deep sub-micron ⇒new tools
Probing attacks become very expensiveFocused Ion Beam (FIB)
• 5 to 10 nm diameter• Beam currents from 1 pA to 10 nA• Very high resolution imaging• Material removal with very high precision• Combined with gas injectors material deposition (platinum or insulator)• Create new pads
– Drill a hole to a metal line– Fill with platinum– Create pad on surface for easy access
• Cost : from 500 k-euros to several M-euros• FIB time can be rented at much lower cost• Can be used to repair the test circuitry (fused after manufacturing and test) and dump
memory (more on this later)
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.14/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Deep sub-micron ⇒new tools
Probing attacks become very expensiveFocused Ion Beam (FIB)
• 5 to 10 nm diameter• Beam currents from 1 pA to 10 nA• Very high resolution imaging• Material removal with very high precision• Combined with gas injectors material deposition (platinum or insulator)• Create new pads
– Drill a hole to a metal line– Fill with platinum– Create pad on surface for easy access
• Cost : from 500 k-euros to several M-euros• FIB time can be rented at much lower cost• Can be used to repair the test circuitry (fused after manufacturing and test) and dump
memory (more on this later)
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.14/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Deep sub-micron ⇒new tools
Probing attacks become very expensiveFocused Ion Beam (FIB)
• 5 to 10 nm diameter• Beam currents from 1 pA to 10 nA• Very high resolution imaging• Material removal with very high precision• Combined with gas injectors material deposition (platinum or insulator)• Create new pads
– Drill a hole to a metal line– Fill with platinum– Create pad on surface for easy access
• Cost : from 500 k-euros to several M-euros• FIB time can be rented at much lower cost• Can be used to repair the test circuitry (fused after manufacturing and test) and dump
memory (more on this later)
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.14/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Deep sub-micron ⇒new tools
Probing attacks become very expensiveFocused Ion Beam (FIB)
• 5 to 10 nm diameter• Beam currents from 1 pA to 10 nA• Very high resolution imaging• Material removal with very high precision• Combined with gas injectors material deposition (platinum or insulator)• Create new pads
– Drill a hole to a metal line– Fill with platinum– Create pad on surface for easy access
• Cost : from 500 k-euros to several M-euros• FIB time can be rented at much lower cost• Can be used to repair the test circuitry (fused after manufacturing and test) and dump
memory (more on this later)
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.14/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Deep sub-micron ⇒new tools
Probing attacks become very expensiveFocused Ion Beam (FIB)
• 5 to 10 nm diameter• Beam currents from 1 pA to 10 nA• Very high resolution imaging• Material removal with very high precision• Combined with gas injectors material deposition (platinum or insulator)• Create new pads
– Drill a hole to a metal line– Fill with platinum– Create pad on surface for easy access
• Cost : from 500 k-euros to several M-euros• FIB time can be rented at much lower cost• Can be used to repair the test circuitry (fused after manufacturing and test) and dump
memory (more on this later)
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.14/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Deep sub-micron ⇒new tools
Probing attacks become very expensiveFocused Ion Beam (FIB)
• 5 to 10 nm diameter• Beam currents from 1 pA to 10 nA• Very high resolution imaging• Material removal with very high precision• Combined with gas injectors material deposition (platinum or insulator)• Create new pads
– Drill a hole to a metal line– Fill with platinum– Create pad on surface for easy access
• Cost : from 500 k-euros to several M-euros• FIB time can be rented at much lower cost• Can be used to repair the test circuitry (fused after manufacturing and test) and dump
memory (more on this later)
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.14/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Deep sub-micron ⇒new tools
Probing attacks become very expensiveFocused Ion Beam (FIB)
• 5 to 10 nm diameter• Beam currents from 1 pA to 10 nA• Very high resolution imaging• Material removal with very high precision• Combined with gas injectors material deposition (platinum or insulator)• Create new pads
– Drill a hole to a metal line– Fill with platinum– Create pad on surface for easy access
• Cost : from 500 k-euros to several M-euros• FIB time can be rented at much lower cost• Can be used to repair the test circuitry (fused after manufacturing and test) and dump
memory (more on this later)
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.14/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Deep sub-micron ⇒new tools
Electron Beam Testers (EBT)• Scanning Electron Microscopes (SEM) with voltage-contrast function• Primary electrons accelerated with voltages about 2.5 kV• Beam currents of about 5 nA• Secondary electrons recorded, number and energy indicates local electric fields on
surface• Relatively low bandwidth (few MHz)
– Slow down clock frequency– Generate periodic transactions and average to reduce noise
• Frequently associated with a FIB for chip imaging and editing
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.15/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Deep sub-micron ⇒new tools
Electron Beam Testers (EBT)• Scanning Electron Microscopes (SEM) with voltage-contrast function• Primary electrons accelerated with voltages about 2.5 kV• Beam currents of about 5 nA• Secondary electrons recorded, number and energy indicates local electric fields on
surface• Relatively low bandwidth (few MHz)
– Slow down clock frequency– Generate periodic transactions and average to reduce noise
• Frequently associated with a FIB for chip imaging and editing
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.15/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Deep sub-micron ⇒new tools
Electron Beam Testers (EBT)• Scanning Electron Microscopes (SEM) with voltage-contrast function• Primary electrons accelerated with voltages about 2.5 kV• Beam currents of about 5 nA• Secondary electrons recorded, number and energy indicates local electric fields on
surface• Relatively low bandwidth (few MHz)
– Slow down clock frequency– Generate periodic transactions and average to reduce noise
• Frequently associated with a FIB for chip imaging and editing
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.15/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Deep sub-micron ⇒new tools
Electron Beam Testers (EBT)• Scanning Electron Microscopes (SEM) with voltage-contrast function• Primary electrons accelerated with voltages about 2.5 kV• Beam currents of about 5 nA• Secondary electrons recorded, number and energy indicates local electric fields on
surface• Relatively low bandwidth (few MHz)
– Slow down clock frequency– Generate periodic transactions and average to reduce noise
• Frequently associated with a FIB for chip imaging and editing
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.15/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Deep sub-micron ⇒new tools
Electron Beam Testers (EBT)• Scanning Electron Microscopes (SEM) with voltage-contrast function• Primary electrons accelerated with voltages about 2.5 kV• Beam currents of about 5 nA• Secondary electrons recorded, number and energy indicates local electric fields on
surface• Relatively low bandwidth (few MHz)
– Slow down clock frequency– Generate periodic transactions and average to reduce noise
• Frequently associated with a FIB for chip imaging and editing
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.15/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Deep sub-micron ⇒new tools
Electron Beam Testers (EBT)• Scanning Electron Microscopes (SEM) with voltage-contrast function• Primary electrons accelerated with voltages about 2.5 kV• Beam currents of about 5 nA• Secondary electrons recorded, number and energy indicates local electric fields on
surface• Relatively low bandwidth (few MHz)
– Slow down clock frequency– Generate periodic transactions and average to reduce noise
• Frequently associated with a FIB for chip imaging and editing
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.15/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Deep sub-micron ⇒new tools
Electron Beam Testers (EBT)• Scanning Electron Microscopes (SEM) with voltage-contrast function• Primary electrons accelerated with voltages about 2.5 kV• Beam currents of about 5 nA• Secondary electrons recorded, number and energy indicates local electric fields on
surface• Relatively low bandwidth (few MHz)
– Slow down clock frequency– Generate periodic transactions and average to reduce noise
• Frequently associated with a FIB for chip imaging and editing
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.15/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Deep sub-micron ⇒new tools
Electron Beam Testers (EBT)• Scanning Electron Microscopes (SEM) with voltage-contrast function• Primary electrons accelerated with voltages about 2.5 kV• Beam currents of about 5 nA• Secondary electrons recorded, number and energy indicates local electric fields on
surface• Relatively low bandwidth (few MHz)
– Slow down clock frequency– Generate periodic transactions and average to reduce noise
• Frequently associated with a FIB for chip imaging and editing
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.15/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Deep sub-micron ⇒new tools
Electron Beam Testers (EBT)• Scanning Electron Microscopes (SEM) with voltage-contrast function• Primary electrons accelerated with voltages about 2.5 kV• Beam currents of about 5 nA• Secondary electrons recorded, number and energy indicates local electric fields on
surface• Relatively low bandwidth (few MHz)
– Slow down clock frequency– Generate periodic transactions and average to reduce noise
• Frequently associated with a FIB for chip imaging and editing
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.15/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Deep sub-micron ⇒new tools
Source: Technical Sales SolutionsSource: Fibics Incorporated
Nano Sculpting
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.16/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Deep sub-micron ⇒new tools
Source: Technical Sales SolutionsSource: Fibics Incorporated
Nano Sculpting
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.16/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Deep sub-micron ⇒new tools
Source: Technical Sales Solutions
Source: Fibics Incorporated
Nano Sculpting
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.16/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Deep sub-micron ⇒new tools
Source: Technical Sales Solutions
Source: Fibics Incorporated
Nano Sculpting
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.16/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Deep sub-micron ⇒new tools
Source: Technical Sales SolutionsSource: Fibics Incorporated
Nano Sculpting
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.16/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Deep sub-micron ⇒new tools
Source: Technical Sales SolutionsSource: Fibics Incorporated
Nano Sculpting
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.16/88 Institut Mines-Telecom R. Pacalet April 21, 2020
On-chip attacks / Countermeasures against on-chipprobing
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.17/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Countermeasures
Random place and route to scatter the registers across the chip• More difficult to retrieve stored values
Encipher the content of memories• More difficult to retrieve stored values• But this should not impose penalties on performances
Use sensors (low and high temperatures, UV, infra-red, X-rays, ionising radiations,clock frequency, voltage, ...)
• But the device still need a power source to react when intrusion is detected• For non self-powered devices (smartcards) the sensors could be destroyed when power is
off ⇒they must be tested periodically in normal operation
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.18/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Countermeasures
Random place and route to scatter the registers across the chip• More difficult to retrieve stored values
Encipher the content of memories• More difficult to retrieve stored values• But this should not impose penalties on performances
Use sensors (low and high temperatures, UV, infra-red, X-rays, ionising radiations,clock frequency, voltage, ...)
• But the device still need a power source to react when intrusion is detected• For non self-powered devices (smartcards) the sensors could be destroyed when power is
off ⇒they must be tested periodically in normal operation
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.18/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Countermeasures
Random place and route to scatter the registers across the chip• More difficult to retrieve stored values
Encipher the content of memories• More difficult to retrieve stored values• But this should not impose penalties on performances
Use sensors (low and high temperatures, UV, infra-red, X-rays, ionising radiations,clock frequency, voltage, ...)
• But the device still need a power source to react when intrusion is detected• For non self-powered devices (smartcards) the sensors could be destroyed when power is
off ⇒they must be tested periodically in normal operation
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.18/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Countermeasures
Random place and route to scatter the registers across the chip• More difficult to retrieve stored values
Encipher the content of memories• More difficult to retrieve stored values• But this should not impose penalties on performances
Use sensors (low and high temperatures, UV, infra-red, X-rays, ionising radiations,clock frequency, voltage, ...)
• But the device still need a power source to react when intrusion is detected• For non self-powered devices (smartcards) the sensors could be destroyed when power is
off ⇒they must be tested periodically in normal operation
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.18/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Countermeasures
Random place and route to scatter the registers across the chip• More difficult to retrieve stored values
Encipher the content of memories• More difficult to retrieve stored values• But this should not impose penalties on performances
Use sensors (low and high temperatures, UV, infra-red, X-rays, ionising radiations,clock frequency, voltage, ...)
• But the device still need a power source to react when intrusion is detected• For non self-powered devices (smartcards) the sensors could be destroyed when power is
off ⇒they must be tested periodically in normal operation
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.18/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Countermeasures
Random place and route to scatter the registers across the chip• More difficult to retrieve stored values
Encipher the content of memories• More difficult to retrieve stored values• But this should not impose penalties on performances
Use sensors (low and high temperatures, UV, infra-red, X-rays, ionising radiations,clock frequency, voltage, ...)
• But the device still need a power source to react when intrusion is detected• For non self-powered devices (smartcards) the sensors could be destroyed when power is
off ⇒they must be tested periodically in normal operation
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.18/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Countermeasures
Random place and route to scatter the registers across the chip• More difficult to retrieve stored values
Encipher the content of memories• More difficult to retrieve stored values• But this should not impose penalties on performances
Use sensors (low and high temperatures, UV, infra-red, X-rays, ionising radiations,clock frequency, voltage, ...)
• But the device still need a power source to react when intrusion is detected• For non self-powered devices (smartcards) the sensors could be destroyed when power is
off ⇒they must be tested periodically in normal operation
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.18/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Countermeasures
Random place and route to scatter the registers across the chip• More difficult to retrieve stored values
Encipher the content of memories• More difficult to retrieve stored values• But this should not impose penalties on performances
Use sensors (low and high temperatures, UV, infra-red, X-rays, ionising radiations,clock frequency, voltage, ...)
• But the device still need a power source to react when intrusion is detected• For non self-powered devices (smartcards) the sensors could be destroyed when power is
off ⇒they must be tested periodically in normal operation
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.18/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Countermeasures
Introduce randomness intimings:
• Dummy clock cyclespopulated with dummycomputations
• Randomizedmultithreading withduplicated register banksto speed-up the contextswitch
Really destroy test circuitry• Test on wafer• Test circuitry cut off by
wafer saw
FIB secondary-electron image Interrupted white line at bottom ofcavity is a blown polysilicon fuse next to a test pad
Source: Oliver Kömmerling, Marcus Kuhn
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.19/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Countermeasures
Introduce randomness intimings:
• Dummy clock cyclespopulated with dummycomputations
• Randomizedmultithreading withduplicated register banksto speed-up the contextswitch
Really destroy test circuitry• Test on wafer• Test circuitry cut off by
wafer saw
FIB secondary-electron image Interrupted white line at bottom ofcavity is a blown polysilicon fuse next to a test pad
Source: Oliver Kömmerling, Marcus Kuhn
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.19/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Countermeasures
Introduce randomness intimings:
• Dummy clock cyclespopulated with dummycomputations
• Randomizedmultithreading withduplicated register banksto speed-up the contextswitch
Really destroy test circuitry• Test on wafer• Test circuitry cut off by
wafer saw
FIB secondary-electron image Interrupted white line at bottom ofcavity is a blown polysilicon fuse next to a test pad
Source: Oliver Kömmerling, Marcus Kuhn
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.19/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Countermeasures
Introduce randomness intimings:
• Dummy clock cyclespopulated with dummycomputations
• Randomizedmultithreading withduplicated register banksto speed-up the contextswitch
Really destroy test circuitry• Test on wafer• Test circuitry cut off by
wafer saw
FIB secondary-electron image Interrupted white line at bottom ofcavity is a blown polysilicon fuse next to a test pad
Source: Oliver Kömmerling, Marcus Kuhn
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.19/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Countermeasures
Introduce randomness intimings:
• Dummy clock cyclespopulated with dummycomputations
• Randomizedmultithreading withduplicated register banksto speed-up the contextswitch
Really destroy test circuitry• Test on wafer• Test circuitry cut off by
wafer saw
FIB secondary-electron image Interrupted white line at bottom ofcavity is a blown polysilicon fuse next to a test pad
Source: Oliver Kömmerling, Marcus Kuhn
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.19/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Countermeasures
Introduce randomness intimings:
• Dummy clock cyclespopulated with dummycomputations
• Randomizedmultithreading withduplicated register banksto speed-up the contextswitch
Really destroy test circuitry• Test on wafer• Test circuitry cut off by
wafer saw
FIB secondary-electron image Interrupted white line at bottom ofcavity is a blown polysilicon fuse next to a test pad
Source: Oliver Kömmerling, Marcus Kuhn
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.19/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Countermeasures
Introduce randomness intimings:
• Dummy clock cyclespopulated with dummycomputations
• Randomizedmultithreading withduplicated register banksto speed-up the contextswitch
Really destroy test circuitry• Test on wafer• Test circuitry cut off by
wafer saw
FIB secondary-electron image Interrupted white line at bottom ofcavity is a blown polysilicon fuse next to a test pad
Source: Oliver Kömmerling, Marcus Kuhn
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.19/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Countermeasures
Introduce randomness intimings:
• Dummy clock cyclespopulated with dummycomputations
• Randomizedmultithreading withduplicated register banksto speed-up the contextswitch
Really destroy test circuitry• Test on wafer• Test circuitry cut off by
wafer saw
FIB secondary-electron image Interrupted white line at bottom ofcavity is a blown polysilicon fuse next to a test pad
Source: Oliver Kömmerling, Marcus Kuhn
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.19/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Countermeasures
Use restricted program counter (Page + Offset)• Prevent the use of PC to dump memory• Force to have a jump at least every N (small) instructions• Reset system when offset counter wraps around
Add top layer sensor meshes• Additional metal layer used to form a mesh on top of secured areas• Continuously monitored during operation• But FIB and EBT can be used efficiently against meshes...
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.20/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Countermeasures
Use restricted program counter (Page + Offset)• Prevent the use of PC to dump memory• Force to have a jump at least every N (small) instructions• Reset system when offset counter wraps around
Add top layer sensor meshes• Additional metal layer used to form a mesh on top of secured areas• Continuously monitored during operation• But FIB and EBT can be used efficiently against meshes...
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.20/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Countermeasures
Use restricted program counter (Page + Offset)• Prevent the use of PC to dump memory• Force to have a jump at least every N (small) instructions• Reset system when offset counter wraps around
Add top layer sensor meshes• Additional metal layer used to form a mesh on top of secured areas• Continuously monitored during operation• But FIB and EBT can be used efficiently against meshes...
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.20/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Countermeasures
Use restricted program counter (Page + Offset)• Prevent the use of PC to dump memory• Force to have a jump at least every N (small) instructions• Reset system when offset counter wraps around
Add top layer sensor meshes• Additional metal layer used to form a mesh on top of secured areas• Continuously monitored during operation• But FIB and EBT can be used efficiently against meshes...
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.20/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Countermeasures
Use restricted program counter (Page + Offset)• Prevent the use of PC to dump memory• Force to have a jump at least every N (small) instructions• Reset system when offset counter wraps around
Add top layer sensor meshes• Additional metal layer used to form a mesh on top of secured areas• Continuously monitored during operation• But FIB and EBT can be used efficiently against meshes...
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.20/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Countermeasures
Use restricted program counter (Page + Offset)• Prevent the use of PC to dump memory• Force to have a jump at least every N (small) instructions• Reset system when offset counter wraps around
Add top layer sensor meshes• Additional metal layer used to form a mesh on top of secured areas• Continuously monitored during operation• But FIB and EBT can be used efficiently against meshes...
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.20/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Countermeasures
Use restricted program counter (Page + Offset)• Prevent the use of PC to dump memory• Force to have a jump at least every N (small) instructions• Reset system when offset counter wraps around
Add top layer sensor meshes• Additional metal layer used to form a mesh on top of secured areas• Continuously monitored during operation• But FIB and EBT can be used efficiently against meshes...
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.20/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Countermeasures
Use restricted program counter (Page + Offset)• Prevent the use of PC to dump memory• Force to have a jump at least every N (small) instructions• Reset system when offset counter wraps around
Add top layer sensor meshes• Additional metal layer used to form a mesh on top of secured areas• Continuously monitored during operation• But FIB and EBT can be used efficiently against meshes...
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.20/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Sensor meshes
Mesh leaving some probe targets unprotected
Source: Oliver Kömmerling, Marcus Kuhn
Mesh after hole drill and metal cross deposit by FIB
Unused lines in mesh removed to ease access to deeper lines
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.21/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Sensor meshes
Mesh leaving some probe targets unprotected
Source: Oliver Kömmerling, Marcus Kuhn
Mesh after hole drill and metal cross deposit by FIB
Unused lines in mesh removed to ease access to deeper lines
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.21/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Sensor meshes
Mesh leaving some probe targets unprotected
Source: Oliver Kömmerling, Marcus Kuhn
Mesh after hole drill and metal cross deposit by FIB
Unused lines in mesh removed to ease access to deeper lines
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.21/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Sensor meshes
Mesh leaving some probe targets unprotected
Source: Oliver Kömmerling, Marcus Kuhn
Mesh after hole drill and metal cross deposit by FIB
Unused lines in mesh removed to ease access to deeper lines
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.21/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Sensor meshes
Mesh leaving some probe targets unprotected
Source: Oliver Kömmerling, Marcus Kuhn
Mesh after hole drill and metal cross deposit by FIB
Unused lines in mesh removed to ease access to deeper lines
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.21/88 Institut Mines-Telecom R. Pacalet April 21, 2020
On-chip attacks / Examples of on-chip probing
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.22/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Probing attack on modular exponentiationTargets RSA, DSA, El Gamal, Schnorr, ..., w-bits secret exponent D
✓ H1: the algorithm implements the square and multiply, one bit at a time (SM-1), anduses a w-bits accumulator A
✓ H2: the attacker probes a bit 0≤ i <w of A during the computation
Algorithm 1 Modular exponentiation1: A−1 ← 1 ▷ initial value of accumulator2: for k ← 0,w −1 do ▷ loop from MSB (bit #0) to LSB (bit #w −1) of D3: Bk ←A2
k−1 mod N ▷ modular square4: if D(k)= 1 then5: Ak ← (Bk ×M) mod N ▷ modular mult6: else7: Ak ←Bk8: end if9: Probe ▷ Probe and record Pk =Ak (i)10: end for11: return Aw−1 =MD mod N
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.23/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Probing attack on modular exponentiationTargets RSA, DSA, El Gamal, Schnorr, ..., w-bits secret exponent D
✓ H1: the algorithm implements the square and multiply, one bit at a time (SM-1), anduses a w-bits accumulator A
✓ H2: the attacker probes a bit 0≤ i <w of A during the computation
Algorithm 1 Modular exponentiation1: A−1 ← 1 ▷ initial value of accumulator2: for k ← 0,w −1 do ▷ loop from MSB (bit #0) to LSB (bit #w −1) of D3: Bk ←A2
k−1 mod N ▷ modular square4: if D(k)= 1 then5: Ak ← (Bk ×M) mod N ▷ modular mult6: else7: Ak ←Bk8: end if9: Probe ▷ Probe and record Pk =Ak (i)10: end for11: return Aw−1 =MD mod N
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.23/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Probing attack on modular exponentiationTargets RSA, DSA, El Gamal, Schnorr, ..., w-bits secret exponent D
✓ H1: the algorithm implements the square and multiply, one bit at a time (SM-1), anduses a w-bits accumulator A
✓ H2: the attacker probes a bit 0≤ i <w of A during the computation
Algorithm 1 Modular exponentiation1: A−1 ← 1 ▷ initial value of accumulator2: for k ← 0,w −1 do ▷ loop from MSB (bit #0) to LSB (bit #w −1) of D3: Bk ←A2
k−1 mod N ▷ modular square4: if D(k)= 1 then5: Ak ← (Bk ×M) mod N ▷ modular mult6: else7: Ak ←Bk8: end if9: Probe ▷ Probe and record Pk =Ak (i)10: end for11: return Aw−1 =MD mod N
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.23/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Probing attack on modular exponentiationTargets RSA, DSA, El Gamal, Schnorr, ..., w-bits secret exponent D
✓ H1: the algorithm implements the square and multiply, one bit at a time (SM-1), anduses a w-bits accumulator A
✓ H2: the attacker probes a bit 0≤ i <w of A during the computation
Algorithm 1 Modular exponentiation1: A−1 ← 1 ▷ initial value of accumulator2: for k ← 0,w −1 do ▷ loop from MSB (bit #0) to LSB (bit #w −1) of D3: Bk ←A2
k−1 mod N ▷ modular square4: if D(k)= 1 then5: Ak ← (Bk ×M) mod N ▷ modular mult6: else7: Ak ←Bk8: end if9: Probe ▷ Probe and record Pk =Ak (i)10: end for11: return Aw−1 =MD mod N
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.23/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Probing attack on modular exponentiation
Let Pk be the value of the probed bit of A at end of iteration kLet {P0, ...,Pk } be the series of k +1 first probed valuesLet D(0...k), 0≤ k <w be the k +1 leading (leftmost) bits of DFor a given hypothesis δ on D(0...k)
• Attacker can simulate SM-1 algorithm for k +1 first iterations...• ...including the probe outcomes {P0, ...,Pk }(δ)...• ...that is, what the probe should output if D(0...k)= δ
If {P0, ...,Pk }(δ)= {P0, ...,Pk }, δ is plausible......else δ is incorrect and shall be discardedNote: plausible does not mean correct
• Simulated and real probed values can coincide by accident...• ...while δ =D(0...k)
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.24/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Probing attack on modular exponentiation
Let Pk be the value of the probed bit of A at end of iteration kLet {P0, ...,Pk } be the series of k +1 first probed valuesLet D(0...k), 0≤ k <w be the k +1 leading (leftmost) bits of DFor a given hypothesis δ on D(0...k)
• Attacker can simulate SM-1 algorithm for k +1 first iterations...• ...including the probe outcomes {P0, ...,Pk }(δ)...• ...that is, what the probe should output if D(0...k)= δ
If {P0, ...,Pk }(δ)= {P0, ...,Pk }, δ is plausible......else δ is incorrect and shall be discardedNote: plausible does not mean correct
• Simulated and real probed values can coincide by accident...• ...while δ =D(0...k)
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.24/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Probing attack on modular exponentiation
Let Pk be the value of the probed bit of A at end of iteration kLet {P0, ...,Pk } be the series of k +1 first probed valuesLet D(0...k), 0≤ k <w be the k +1 leading (leftmost) bits of DFor a given hypothesis δ on D(0...k)
• Attacker can simulate SM-1 algorithm for k +1 first iterations...• ...including the probe outcomes {P0, ...,Pk }(δ)...• ...that is, what the probe should output if D(0...k)= δ
If {P0, ...,Pk }(δ)= {P0, ...,Pk }, δ is plausible......else δ is incorrect and shall be discardedNote: plausible does not mean correct
• Simulated and real probed values can coincide by accident...• ...while δ =D(0...k)
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.24/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Probing attack on modular exponentiation
Let Pk be the value of the probed bit of A at end of iteration kLet {P0, ...,Pk } be the series of k +1 first probed valuesLet D(0...k), 0≤ k <w be the k +1 leading (leftmost) bits of DFor a given hypothesis δ on D(0...k)
• Attacker can simulate SM-1 algorithm for k +1 first iterations...• ...including the probe outcomes {P0, ...,Pk }(δ)...• ...that is, what the probe should output if D(0...k)= δ
If {P0, ...,Pk }(δ)= {P0, ...,Pk }, δ is plausible......else δ is incorrect and shall be discardedNote: plausible does not mean correct
• Simulated and real probed values can coincide by accident...• ...while δ =D(0...k)
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.24/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Probing attack on modular exponentiation
Let Pk be the value of the probed bit of A at end of iteration kLet {P0, ...,Pk } be the series of k +1 first probed valuesLet D(0...k), 0≤ k <w be the k +1 leading (leftmost) bits of DFor a given hypothesis δ on D(0...k)
• Attacker can simulate SM-1 algorithm for k +1 first iterations...• ...including the probe outcomes {P0, ...,Pk }(δ)...• ...that is, what the probe should output if D(0...k)= δ
If {P0, ...,Pk }(δ)= {P0, ...,Pk }, δ is plausible......else δ is incorrect and shall be discardedNote: plausible does not mean correct
• Simulated and real probed values can coincide by accident...• ...while δ =D(0...k)
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.24/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Probing attack on modular exponentiation
Let Pk be the value of the probed bit of A at end of iteration kLet {P0, ...,Pk } be the series of k +1 first probed valuesLet D(0...k), 0≤ k <w be the k +1 leading (leftmost) bits of DFor a given hypothesis δ on D(0...k)
• Attacker can simulate SM-1 algorithm for k +1 first iterations...• ...including the probe outcomes {P0, ...,Pk }(δ)...• ...that is, what the probe should output if D(0...k)= δ
If {P0, ...,Pk }(δ)= {P0, ...,Pk }, δ is plausible......else δ is incorrect and shall be discardedNote: plausible does not mean correct
• Simulated and real probed values can coincide by accident...• ...while δ =D(0...k)
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.24/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Probing attack on modular exponentiation
Let Pk be the value of the probed bit of A at end of iteration kLet {P0, ...,Pk } be the series of k +1 first probed valuesLet D(0...k), 0≤ k <w be the k +1 leading (leftmost) bits of DFor a given hypothesis δ on D(0...k)
• Attacker can simulate SM-1 algorithm for k +1 first iterations...• ...including the probe outcomes {P0, ...,Pk }(δ)...• ...that is, what the probe should output if D(0...k)= δ
If {P0, ...,Pk }(δ)= {P0, ...,Pk }, δ is plausible......else δ is incorrect and shall be discardedNote: plausible does not mean correct
• Simulated and real probed values can coincide by accident...• ...while δ =D(0...k)
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.24/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Probing attack on modular exponentiation
Let Pk be the value of the probed bit of A at end of iteration kLet {P0, ...,Pk } be the series of k +1 first probed valuesLet D(0...k), 0≤ k <w be the k +1 leading (leftmost) bits of DFor a given hypothesis δ on D(0...k)
• Attacker can simulate SM-1 algorithm for k +1 first iterations...• ...including the probe outcomes {P0, ...,Pk }(δ)...• ...that is, what the probe should output if D(0...k)= δ
If {P0, ...,Pk }(δ)= {P0, ...,Pk }, δ is plausible......else δ is incorrect and shall be discardedNote: plausible does not mean correct
• Simulated and real probed values can coincide by accident...• ...while δ =D(0...k)
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.24/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Probing attack on modular exponentiation
Let Pk be the value of the probed bit of A at end of iteration kLet {P0, ...,Pk } be the series of k +1 first probed valuesLet D(0...k), 0≤ k <w be the k +1 leading (leftmost) bits of DFor a given hypothesis δ on D(0...k)
• Attacker can simulate SM-1 algorithm for k +1 first iterations...• ...including the probe outcomes {P0, ...,Pk }(δ)...• ...that is, what the probe should output if D(0...k)= δ
If {P0, ...,Pk }(δ)= {P0, ...,Pk }, δ is plausible......else δ is incorrect and shall be discardedNote: plausible does not mean correct
• Simulated and real probed values can coincide by accident...• ...while δ =D(0...k)
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.24/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Probing attack on modular exponentiation
Let Pk be the value of the probed bit of A at end of iteration kLet {P0, ...,Pk } be the series of k +1 first probed valuesLet D(0...k), 0≤ k <w be the k +1 leading (leftmost) bits of DFor a given hypothesis δ on D(0...k)
• Attacker can simulate SM-1 algorithm for k +1 first iterations...• ...including the probe outcomes {P0, ...,Pk }(δ)...• ...that is, what the probe should output if D(0...k)= δ
If {P0, ...,Pk }(δ)= {P0, ...,Pk }, δ is plausible......else δ is incorrect and shall be discardedNote: plausible does not mean correct
• Simulated and real probed values can coincide by accident...• ...while δ =D(0...k)
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.24/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Probing attack on modular exponentiation
Let Pk be the value of the probed bit of A at end of iteration kLet {P0, ...,Pk } be the series of k +1 first probed valuesLet D(0...k), 0≤ k <w be the k +1 leading (leftmost) bits of DFor a given hypothesis δ on D(0...k)
• Attacker can simulate SM-1 algorithm for k +1 first iterations...• ...including the probe outcomes {P0, ...,Pk }(δ)...• ...that is, what the probe should output if D(0...k)= δ
If {P0, ...,Pk }(δ)= {P0, ...,Pk }, δ is plausible......else δ is incorrect and shall be discardedNote: plausible does not mean correct
• Simulated and real probed values can coincide by accident...• ...while δ =D(0...k)
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.24/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Probing attack on modular exponentiation
Let Pk be the value of the probed bit of A at end of iteration kLet {P0, ...,Pk } be the series of k +1 first probed valuesLet D(0...k), 0≤ k <w be the k +1 leading (leftmost) bits of DFor a given hypothesis δ on D(0...k)
• Attacker can simulate SM-1 algorithm for k +1 first iterations...• ...including the probe outcomes {P0, ...,Pk }(δ)...• ...that is, what the probe should output if D(0...k)= δ
If {P0, ...,Pk }(δ)= {P0, ...,Pk }, δ is plausible......else δ is incorrect and shall be discardedNote: plausible does not mean correct
• Simulated and real probed values can coincide by accident...• ...while δ =D(0...k)
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.24/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Probing attack on modular exponentiation
Let Pk be the value of the probed bit of A at end of iteration kLet {P0, ...,Pk } be the series of k +1 first probed valuesLet D(0...k), 0≤ k <w be the k +1 leading (leftmost) bits of DFor a given hypothesis δ on D(0...k)
• Attacker can simulate SM-1 algorithm for k +1 first iterations...• ...including the probe outcomes {P0, ...,Pk }(δ)...• ...that is, what the probe should output if D(0...k)= δ
If {P0, ...,Pk }(δ)= {P0, ...,Pk }, δ is plausible......else δ is incorrect and shall be discardedNote: plausible does not mean correct
• Simulated and real probed values can coincide by accident...• ...while δ =D(0...k)
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.24/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Probing attack on modular exponentiation
Let ∆k be the set of the remaining plausible guesses δ after interation kLet S&b be the right-concatenation of bit b to bit-string SLet () be the empty bit-string
Algorithm 2 Attack algorithm1: ∆−1 ← {()} ▷ Start with empty bit-string2: for k ← 0,w −1 do ▷ loop from MSB to LSB of D3: Γk ← {δ&0,δ&1 | δ ∈∆k−1} ▷ Expand with two possible next bits4: ∆k ← {δ ∈ Γk | {P0 , ...,Pk }(δ)= {P0 , ...,Pk } ▷ Filter out non-plausible5: end for6: return ∆w−1 ▷ Final remaining plausible guesses for D
Will the number of remaining guesses (|∆k |) explode?
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.25/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Probing attack on modular exponentiation
Let ∆k be the set of the remaining plausible guesses δ after interation kLet S&b be the right-concatenation of bit b to bit-string SLet () be the empty bit-string
Algorithm 2 Attack algorithm1: ∆−1 ← {()} ▷ Start with empty bit-string2: for k ← 0,w −1 do ▷ loop from MSB to LSB of D3: Γk ← {δ&0,δ&1 | δ ∈∆k−1} ▷ Expand with two possible next bits4: ∆k ← {δ ∈ Γk | {P0 , ...,Pk }(δ)= {P0 , ...,Pk } ▷ Filter out non-plausible5: end for6: return ∆w−1 ▷ Final remaining plausible guesses for D
Will the number of remaining guesses (|∆k |) explode?
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.25/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Probing attack on modular exponentiation
Let ∆k be the set of the remaining plausible guesses δ after interation kLet S&b be the right-concatenation of bit b to bit-string SLet () be the empty bit-string
Algorithm 2 Attack algorithm1: ∆−1 ← {()} ▷ Start with empty bit-string2: for k ← 0,w −1 do ▷ loop from MSB to LSB of D3: Γk ← {δ&0,δ&1 | δ ∈∆k−1} ▷ Expand with two possible next bits4: ∆k ← {δ ∈ Γk | {P0 , ...,Pk }(δ)= {P0 , ...,Pk } ▷ Filter out non-plausible5: end for6: return ∆w−1 ▷ Final remaining plausible guesses for D
Will the number of remaining guesses (|∆k |) explode?
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.25/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Probing attack on modular exponentiation
Let ∆k be the set of the remaining plausible guesses δ after interation kLet S&b be the right-concatenation of bit b to bit-string SLet () be the empty bit-string
Algorithm 2 Attack algorithm1: ∆−1 ← {()} ▷ Start with empty bit-string2: for k ← 0,w −1 do ▷ loop from MSB to LSB of D3: Γk ← {δ&0,δ&1 | δ ∈∆k−1} ▷ Expand with two possible next bits4: ∆k ← {δ ∈ Γk | {P0 , ...,Pk }(δ)= {P0 , ...,Pk } ▷ Filter out non-plausible5: end for6: return ∆w−1 ▷ Final remaining plausible guesses for D
Will the number of remaining guesses (|∆k |) explode?
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.25/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Probing attack on modular exponentiation
Let ∆k be the set of the remaining plausible guesses δ after interation kLet S&b be the right-concatenation of bit b to bit-string SLet () be the empty bit-string
Algorithm 2 Attack algorithm1: ∆−1 ← {()} ▷ Start with empty bit-string2: for k ← 0,w −1 do ▷ loop from MSB to LSB of D3: Γk ← {δ&0,δ&1 | δ ∈∆k−1} ▷ Expand with two possible next bits4: ∆k ← {δ ∈ Γk | {P0 , ...,Pk }(δ)= {P0 , ...,Pk } ▷ Filter out non-plausible5: end for6: return ∆w−1 ▷ Final remaining plausible guesses for D
Will the number of remaining guesses (|∆k |) explode?
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.25/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Probing attack on modular exponentiation
Let ∆k be the set of the remaining plausible guesses δ after interation kLet S&b be the right-concatenation of bit b to bit-string SLet () be the empty bit-string
Algorithm 2 Attack algorithm1: ∆−1 ← {()} ▷ Start with empty bit-string2: for k ← 0,w −1 do ▷ loop from MSB to LSB of D3: Γk ← {δ&0,δ&1 | δ ∈∆k−1} ▷ Expand with two possible next bits4: ∆k ← {δ ∈ Γk | {P0 , ...,Pk }(δ)= {P0 , ...,Pk } ▷ Filter out non-plausible5: end for6: return ∆w−1 ▷ Final remaining plausible guesses for D
Will the number of remaining guesses (|∆k |) explode?
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.25/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Probing attack on modular exponentiation
1: ∆−1 ← {()} ▷ Start with empty bit-string2: for k ← 0,w −1 do ▷ loop from MSB to LSB of D3: Γk ← {δ&0,δ&1 | δ ∈∆k−1} ▷ Expand with two possible next bits4: ∆k ← {δ ∈ Γk | {P0 , ...,Pk }(δ)= {P0 , ...,Pk } ▷ Filter out non-plausible5: end for6: return ∆w−1 ▷ Final remaining plausible guesses for D
? Exercise #1: Calculate the probability ϵ=P(δ ∈∆k | δ is wrong) that a wrong guess δ
survives the filtering stage (line #4) of the attack (assume bits Pk and Pk areuncorrelated)
? Exercise #2: Calculate uk =E(|∆k |), the average number of remaining guesses afteriteration k ; is this attack practical?
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.26/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Probing attack on modular exponentiation
1: ∆−1 ← {()} ▷ Start with empty bit-string2: for k ← 0,w −1 do ▷ loop from MSB to LSB of D3: Γk ← {δ&0,δ&1 | δ ∈∆k−1} ▷ Expand with two possible next bits4: ∆k ← {δ ∈ Γk | {P0 , ...,Pk }(δ)= {P0 , ...,Pk } ▷ Filter out non-plausible5: end for6: return ∆w−1 ▷ Final remaining plausible guesses for D
? Exercise #1: Calculate the probability ϵ=P(δ ∈∆k | δ is wrong) that a wrong guess δ
survives the filtering stage (line #4) of the attack (assume bits Pk and Pk areuncorrelated)
? Exercise #2: Calculate uk =E(|∆k |), the average number of remaining guesses afteriteration k ; is this attack practical?
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.26/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Probing attack on modular exponentiation
1: ∆−1 ← {()} ▷ Start with empty bit-string2: for k ← 0,w −1 do ▷ loop from MSB to LSB of D3: Γk ← {δ&0,δ&1 | δ ∈∆k−1} ▷ Expand with two possible next bits4: ∆k ← {δ ∈ Γk | {P0 , ...,Pk }(δ)= {P0 , ...,Pk } ▷ Filter out non-plausible5: end for6: return ∆w−1 ▷ Final remaining plausible guesses for D
? Exercise #1: Calculate the probability ϵ=P(δ ∈∆k | δ is wrong) that a wrong guess δ
survives the filtering stage (line #4) of the attack (assume bits Pk and Pk areuncorrelated)
? Exercise #2: Calculate uk =E(|∆k |), the average number of remaining guesses afteriteration k ; is this attack practical?
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.26/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Probing attack on modular exponentiation
1: ∆−1 ← {()} ▷ Start with empty bit-string2: for k ← 0,w −1 do ▷ loop from MSB to LSB of D3: Γk ← {δ&0,δ&1 | δ ∈∆k−1} ▷ Expand with two possible next bits4: ∆k ← {δ ∈ Γk | {P0 , ...,Pk }(δ)= {P0 , ...,Pk } ▷ Filter out non-plausible5: end for6: return ∆w−1 ▷ Final remaining plausible guesses for D
? Exercise #1: Calculate the probability ϵ=P(δ ∈∆k | δ is wrong) that a wrong guess δ
survives the filtering stage (line #4) of the attack (assume bits Pk and Pk areuncorrelated)
? Exercise #2: Calculate uk =E(|∆k |), the average number of remaining guesses afteriteration k ; is this attack practical?
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.26/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Probing attack on modular exponentiation
1: ∆−1 ← {()} ▷ Start with empty bit-string2: for k ← 0,w −1 do ▷ loop from MSB to LSB of D3: Γk ← {δ&0,δ&1 | δ ∈∆k−1} ▷ Expand with two possible next bits4: ∆k ← {δ ∈ Γk | {P0 , ...,Pk }(δ)= {P0 , ...,Pk } ▷ Filter out non-plausible5: end for6: return ∆w−1 ▷ Final remaining plausible guesses for D
? Exercise #1: Calculate the probability ϵ=P(δ ∈∆k | δ is wrong) that a wrong guess δ
survives the filtering stage (line #4) of the attack (assume bits Pk and Pk areuncorrelated)
? Exercise #2: Calculate uk =E(|∆k |), the average number of remaining guesses afteriteration k ; is this attack practical?
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.26/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Probing attack on modular exponentiation
And what happens if attacker doesn’t know i , the index of probed bit (random probingattack)?
? Exercise #3: Design a new algorithm for the attacker? Exercise #4: Calculate the new average number of surviving guesses; is the attack
still practical?? Exercise #5: What if attacker probes several bits (n > 1, indices known)?? Exercise #6: What if attacker probes several bits (n > 1, indices unknown)?
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.27/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Probing attack on modular exponentiation
And what happens if attacker doesn’t know i , the index of probed bit (random probingattack)?
? Exercise #3: Design a new algorithm for the attacker? Exercise #4: Calculate the new average number of surviving guesses; is the attack
still practical?? Exercise #5: What if attacker probes several bits (n > 1, indices known)?? Exercise #6: What if attacker probes several bits (n > 1, indices unknown)?
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.27/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Probing attack on modular exponentiation
And what happens if attacker doesn’t know i , the index of probed bit (random probingattack)?
? Exercise #3: Design a new algorithm for the attacker? Exercise #4: Calculate the new average number of surviving guesses; is the attack
still practical?? Exercise #5: What if attacker probes several bits (n > 1, indices known)?? Exercise #6: What if attacker probes several bits (n > 1, indices unknown)?
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.27/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Probing attack on modular exponentiation
And what happens if attacker doesn’t know i , the index of probed bit (random probingattack)?
? Exercise #3: Design a new algorithm for the attacker? Exercise #4: Calculate the new average number of surviving guesses; is the attack
still practical?? Exercise #5: What if attacker probes several bits (n > 1, indices known)?? Exercise #6: What if attacker probes several bits (n > 1, indices unknown)?
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.27/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Probing attack on modular exponentiation
And what happens if attacker doesn’t know i , the index of probed bit (random probingattack)?
? Exercise #3: Design a new algorithm for the attacker? Exercise #4: Calculate the new average number of surviving guesses; is the attack
still practical?? Exercise #5: What if attacker probes several bits (n > 1, indices known)?? Exercise #6: What if attacker probes several bits (n > 1, indices unknown)?
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.27/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Probing attack on modular exponentiation
And what happens if attacker doesn’t know i , the index of probed bit (random probingattack)?
? Exercise #3: Design a new algorithm for the attacker? Exercise #4: Calculate the new average number of surviving guesses; is the attack
still practical?? Exercise #5: What if attacker probes several bits (n > 1, indices known)?? Exercise #6: What if attacker probes several bits (n > 1, indices unknown)?
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.27/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Probing attack on modular exponentiation
And what happens if attacker doesn’t know i , the index of probed bit (random probingattack)?
? Exercise #3: Design a new algorithm for the attacker? Exercise #4: Calculate the new average number of surviving guesses; is the attack
still practical?? Exercise #5: What if attacker probes several bits (n > 1, indices known)?? Exercise #6: What if attacker probes several bits (n > 1, indices unknown)?
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.27/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Probing attack on modular exponentiation
And what happens if attacker doesn’t know i , the index of probed bit (random probingattack)?
? Exercise #3: Design a new algorithm for the attacker? Exercise #4: Calculate the new average number of surviving guesses; is the attack
still practical?? Exercise #5: What if attacker probes several bits (n > 1, indices known)?? Exercise #6: What if attacker probes several bits (n > 1, indices unknown)?
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.27/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Probing attack on modular exponentiation
And what happens if attacker doesn’t know i , the index of probed bit (random probingattack)?
? Exercise #3: Design a new algorithm for the attacker? Exercise #4: Calculate the new average number of surviving guesses; is the attack
still practical?? Exercise #5: What if attacker probes several bits (n > 1, indices known)?? Exercise #6: What if attacker probes several bits (n > 1, indices unknown)?
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.27/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Probing attack on DES
+ f
f+
f+
16 rounds
Output
FP
IP
Input
R0L0Permuted input
Kn
L15 =R14 R15 = L14⊕ f (R14,K15)
K16
K1
R1 = L0⊕ f (R0,K1)L1 =R0
R16 = L15⊕ f (R15,K16) L16 =R15Preoutput
32
48
32
3232
64
Inverse initial permutation64
Initial permutation64
32 32
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.28/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Probing attack on DES
The probe records bit # b of LSelect corresponding 6 input bitsof FSimulate with every possible 6bits secret subkeyEliminate guesses that do notmatchIn average, 6 different ciphertextsgive 6 bits of K16
Repeat on first round → 6 bits ofK1 (different)Exhaustive search on 44remaining bits
Algorithm 3 DES1: (L0|R0)← IP(M)2: for i ← 1,16 do ▷ 16 rounds3: Li ←Ri−14: Ri ←F(Ri−1 ,Ki )⊕Li−15: end for6: C ← IP−1(R16|L16)
SBox
Ciphertext
4
4
4
10
6 6
6
6
K16
L15 R15
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.29/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Probing attack on DES
The probe records bit # b of LSelect corresponding 6 input bitsof FSimulate with every possible 6bits secret subkeyEliminate guesses that do notmatchIn average, 6 different ciphertextsgive 6 bits of K16
Repeat on first round → 6 bits ofK1 (different)Exhaustive search on 44remaining bits
Algorithm 3 DES1: (L0|R0)← IP(M)2: for i ← 1,16 do ▷ 16 rounds3: Li ←Ri−14: Ri ←F(Ri−1 ,Ki )⊕Li−15: end for6: C ← IP−1(R16|L16)
SBox
Ciphertext
4
4
4
10
6 6
6
6
K16
L15 R15
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.29/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Probing attack on DES
The probe records bit # b of LSelect corresponding 6 input bitsof FSimulate with every possible 6bits secret subkeyEliminate guesses that do notmatchIn average, 6 different ciphertextsgive 6 bits of K16
Repeat on first round → 6 bits ofK1 (different)Exhaustive search on 44remaining bits
Algorithm 3 DES1: (L0|R0)← IP(M)2: for i ← 1,16 do ▷ 16 rounds3: Li ←Ri−14: Ri ←F(Ri−1 ,Ki )⊕Li−15: end for6: C ← IP−1(R16|L16)
SBox
Ciphertext
4
4
4
10
6 6
6
6
K16
L15 R15
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.29/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Probing attack on DES
The probe records bit # b of LSelect corresponding 6 input bitsof FSimulate with every possible 6bits secret subkeyEliminate guesses that do notmatchIn average, 6 different ciphertextsgive 6 bits of K16
Repeat on first round → 6 bits ofK1 (different)Exhaustive search on 44remaining bits
Algorithm 3 DES1: (L0|R0)← IP(M)2: for i ← 1,16 do ▷ 16 rounds3: Li ←Ri−14: Ri ←F(Ri−1 ,Ki )⊕Li−15: end for6: C ← IP−1(R16|L16)
SBox
Ciphertext
4
4
4
10
6 6
6
6
K16
L15 R15
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.29/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Probing attack on DES
The probe records bit # b of LSelect corresponding 6 input bitsof FSimulate with every possible 6bits secret subkeyEliminate guesses that do notmatchIn average, 6 different ciphertextsgive 6 bits of K16
Repeat on first round → 6 bits ofK1 (different)Exhaustive search on 44remaining bits
Algorithm 3 DES1: (L0|R0)← IP(M)2: for i ← 1,16 do ▷ 16 rounds3: Li ←Ri−14: Ri ←F(Ri−1 ,Ki )⊕Li−15: end for6: C ← IP−1(R16|L16)
SBox
Ciphertext
4
4
4
10
6 6
6
6
K16
L15 R15
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.29/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Probing attack on DES
The probe records bit # b of LSelect corresponding 6 input bitsof FSimulate with every possible 6bits secret subkeyEliminate guesses that do notmatchIn average, 6 different ciphertextsgive 6 bits of K16
Repeat on first round → 6 bits ofK1 (different)Exhaustive search on 44remaining bits
Algorithm 3 DES1: (L0|R0)← IP(M)2: for i ← 1,16 do ▷ 16 rounds3: Li ←Ri−14: Ri ←F(Ri−1 ,Ki )⊕Li−15: end for6: C ← IP−1(R16|L16)
SBox
Ciphertext
4
4
4
10
6 6
6
6
K16
L15 R15
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.29/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Probing attack on DES
The probe records bit # b of LSelect corresponding 6 input bitsof FSimulate with every possible 6bits secret subkeyEliminate guesses that do notmatchIn average, 6 different ciphertextsgive 6 bits of K16
Repeat on first round → 6 bits ofK1 (different)Exhaustive search on 44remaining bits
Algorithm 3 DES1: (L0|R0)← IP(M)2: for i ← 1,16 do ▷ 16 rounds3: Li ←Ri−14: Ri ←F(Ri−1 ,Ki )⊕Li−15: end for6: C ← IP−1(R16|L16)
SBox
Ciphertext
4
4
4
10
6 6
6
6
K16
L15 R15
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.29/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Probing attack on DES
The probe records bit # b of LSelect corresponding 6 input bitsof FSimulate with every possible 6bits secret subkeyEliminate guesses that do notmatchIn average, 6 different ciphertextsgive 6 bits of K16
Repeat on first round → 6 bits ofK1 (different)Exhaustive search on 44remaining bits
Algorithm 3 DES1: (L0|R0)← IP(M)2: for i ← 1,16 do ▷ 16 rounds3: Li ←Ri−14: Ri ←F(Ri−1 ,Ki )⊕Li−15: end for6: C ← IP−1(R16|L16)
SBox
Ciphertext
4
4
4
10
6 6
6
6
K16
L15 R15
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.29/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Probing attack on DES
? Exercise #7: How to optimize this attack?? Exercise #8: Is it practical on triple DES?
Homework on Probing Attack• Have a look at at least one of these papers
– Marcus Kuhn against DS5002FP– Cryptopage by Ronan Keryell– Or Google a bit on TrustZone by ARM
• Prepare questions
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.30/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Probing attack on DES
? Exercise #7: How to optimize this attack?? Exercise #8: Is it practical on triple DES?
Homework on Probing Attack• Have a look at at least one of these papers
– Marcus Kuhn against DS5002FP– Cryptopage by Ronan Keryell– Or Google a bit on TrustZone by ARM
• Prepare questions
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.30/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Probing attack on DES
? Exercise #7: How to optimize this attack?? Exercise #8: Is it practical on triple DES?
Homework on Probing Attack• Have a look at at least one of these papers
– Marcus Kuhn against DS5002FP– Cryptopage by Ronan Keryell– Or Google a bit on TrustZone by ARM
• Prepare questions
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.30/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Probing attack on DES
? Exercise #7: How to optimize this attack?? Exercise #8: Is it practical on triple DES?
Homework on Probing Attack• Have a look at at least one of these papers
– Marcus Kuhn against DS5002FP– Cryptopage by Ronan Keryell– Or Google a bit on TrustZone by ARM
• Prepare questions
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.30/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Probing attack on DES
? Exercise #7: How to optimize this attack?? Exercise #8: Is it practical on triple DES?
Homework on Probing Attack• Have a look at at least one of these papers
– Marcus Kuhn against DS5002FP– Cryptopage by Ronan Keryell– Or Google a bit on TrustZone by ARM
• Prepare questions
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.30/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Probing attack on DES
? Exercise #7: How to optimize this attack?? Exercise #8: Is it practical on triple DES?
Homework on Probing Attack• Have a look at at least one of these papers
– Marcus Kuhn against DS5002FP– Cryptopage by Ronan Keryell– Or Google a bit on TrustZone by ARM
• Prepare questions
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.30/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Probing attack on DES
? Exercise #7: How to optimize this attack?? Exercise #8: Is it practical on triple DES?
Homework on Probing Attack• Have a look at at least one of these papers
– Marcus Kuhn against DS5002FP– Cryptopage by Ronan Keryell– Or Google a bit on TrustZone by ARM
• Prepare questions
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.30/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Probing attack on DES
? Exercise #7: How to optimize this attack?? Exercise #8: Is it practical on triple DES?
Homework on Probing Attack• Have a look at at least one of these papers
– Marcus Kuhn against DS5002FP– Cryptopage by Ronan Keryell– Or Google a bit on TrustZone by ARM
• Prepare questions
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.30/88 Institut Mines-Telecom R. Pacalet April 21, 2020
On-board probing attacks
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.31/88 Institut Mines-Telecom R. Pacalet April 21, 2020
The game consoles caseThe Xbox 360 Security System and its Weaknesses
Source: Playstation 3 Hacking – Linux Is Inevitable (http://www.pagetable.com/)
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.32/88 Institut Mines-Telecom R. Pacalet April 21, 2020
The game consoles caseThe Xbox 360 Security System and its Weaknesses
Source: Playstation 3 Hacking – Linux Is Inevitable (http://www.pagetable.com/)
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.32/88 Institut Mines-Telecom R. Pacalet April 21, 2020
The game consoles caseThe Xbox 360 Security System and its Weaknesses
Source: Playstation 3 Hacking – Linux Is Inevitable (http://www.pagetable.com/)
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.32/88 Institut Mines-Telecom R. Pacalet April 21, 2020
The game consoles caseThe Xbox 360 Security System and its Weaknesses
Source: Playstation 3 Hacking – Linux Is Inevitable (http://www.pagetable.com/)
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.32/88 Institut Mines-Telecom R. Pacalet April 21, 2020
On-board probing attacks / Introduction
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.33/88 Institut Mines-Telecom R. Pacalet April 21, 2020
On-board probing
Very convenient way to retrieve secrets• Easier than on-chip• Graduate student level, few $100• But not that easy...
– High frequency busses– Metal tracks in inner PCB layers– Synchronization, storage, etc.
Disk encryption keys from memory busGame consoles reverse-engineering,hacking and piracyActive probing (injection) alter nominalbehavior
• Crypto-CPUs (DS5002FP)• Game consoles (XBox, ...)
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.34/88 Institut Mines-Telecom R. Pacalet April 21, 2020
On-board probing
Very convenient way to retrieve secrets• Easier than on-chip• Graduate student level, few $100• But not that easy...
– High frequency busses– Metal tracks in inner PCB layers– Synchronization, storage, etc.
Disk encryption keys from memory busGame consoles reverse-engineering,hacking and piracyActive probing (injection) alter nominalbehavior
• Crypto-CPUs (DS5002FP)• Game consoles (XBox, ...)
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.34/88 Institut Mines-Telecom R. Pacalet April 21, 2020
On-board probing
Very convenient way to retrieve secrets• Easier than on-chip• Graduate student level, few $100• But not that easy...
– High frequency busses– Metal tracks in inner PCB layers– Synchronization, storage, etc.
Disk encryption keys from memory busGame consoles reverse-engineering,hacking and piracyActive probing (injection) alter nominalbehavior
• Crypto-CPUs (DS5002FP)• Game consoles (XBox, ...)
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.34/88 Institut Mines-Telecom R. Pacalet April 21, 2020
On-board probing
Very convenient way to retrieve secrets• Easier than on-chip• Graduate student level, few $100• But not that easy...
– High frequency busses– Metal tracks in inner PCB layers– Synchronization, storage, etc.
Disk encryption keys from memory busGame consoles reverse-engineering,hacking and piracyActive probing (injection) alter nominalbehavior
• Crypto-CPUs (DS5002FP)• Game consoles (XBox, ...)
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.34/88 Institut Mines-Telecom R. Pacalet April 21, 2020
On-board probing
Very convenient way to retrieve secrets• Easier than on-chip• Graduate student level, few $100• But not that easy...
– High frequency busses– Metal tracks in inner PCB layers– Synchronization, storage, etc.
Disk encryption keys from memory busGame consoles reverse-engineering,hacking and piracyActive probing (injection) alter nominalbehavior
• Crypto-CPUs (DS5002FP)• Game consoles (XBox, ...)
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.34/88 Institut Mines-Telecom R. Pacalet April 21, 2020
On-board probing
Very convenient way to retrieve secrets• Easier than on-chip• Graduate student level, few $100• But not that easy...
– High frequency busses– Metal tracks in inner PCB layers– Synchronization, storage, etc.
Disk encryption keys from memory busGame consoles reverse-engineering,hacking and piracyActive probing (injection) alter nominalbehavior
• Crypto-CPUs (DS5002FP)• Game consoles (XBox, ...)
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.34/88 Institut Mines-Telecom R. Pacalet April 21, 2020
On-board probing
Very convenient way to retrieve secrets• Easier than on-chip• Graduate student level, few $100• But not that easy...
– High frequency busses– Metal tracks in inner PCB layers– Synchronization, storage, etc.
Disk encryption keys from memory busGame consoles reverse-engineering,hacking and piracyActive probing (injection) alter nominalbehavior
• Crypto-CPUs (DS5002FP)• Game consoles (XBox, ...)
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.34/88 Institut Mines-Telecom R. Pacalet April 21, 2020
On-board probing
Very convenient way to retrieve secrets• Easier than on-chip• Graduate student level, few $100• But not that easy...
– High frequency busses– Metal tracks in inner PCB layers– Synchronization, storage, etc.
Disk encryption keys from memory busGame consoles reverse-engineering,hacking and piracyActive probing (injection) alter nominalbehavior
• Crypto-CPUs (DS5002FP)• Game consoles (XBox, ...)
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.34/88 Institut Mines-Telecom R. Pacalet April 21, 2020
On-board probing
Very convenient way to retrieve secrets• Easier than on-chip• Graduate student level, few $100• But not that easy...
– High frequency busses– Metal tracks in inner PCB layers– Synchronization, storage, etc.
Disk encryption keys from memory busGame consoles reverse-engineering,hacking and piracyActive probing (injection) alter nominalbehavior
• Crypto-CPUs (DS5002FP)• Game consoles (XBox, ...)
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.34/88 Institut Mines-Telecom R. Pacalet April 21, 2020
On-board probing
Very convenient way to retrieve secrets• Easier than on-chip• Graduate student level, few $100• But not that easy...
– High frequency busses– Metal tracks in inner PCB layers– Synchronization, storage, etc.
Disk encryption keys from memory busGame consoles reverse-engineering,hacking and piracyActive probing (injection) alter nominalbehavior
• Crypto-CPUs (DS5002FP)• Game consoles (XBox, ...)
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.34/88 Institut Mines-Telecom R. Pacalet April 21, 2020
On-board probing
Very convenient way to retrieve secrets• Easier than on-chip• Graduate student level, few $100• But not that easy...
– High frequency busses– Metal tracks in inner PCB layers– Synchronization, storage, etc.
Disk encryption keys from memory busGame consoles reverse-engineering,hacking and piracyActive probing (injection) alter nominalbehavior
• Crypto-CPUs (DS5002FP)• Game consoles (XBox, ...)
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.34/88 Institut Mines-Telecom R. Pacalet April 21, 2020
On-board probing
Very convenient way to retrieve secrets• Easier than on-chip• Graduate student level, few $100• But not that easy...
– High frequency busses– Metal tracks in inner PCB layers– Synchronization, storage, etc.
Disk encryption keys from memory busGame consoles reverse-engineering,hacking and piracyActive probing (injection) alter nominalbehavior
• Crypto-CPUs (DS5002FP)• Game consoles (XBox, ...)
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.34/88 Institut Mines-Telecom R. Pacalet April 21, 2020
The first step: housing removal
Heat and cut... and open... andrepair...
Source: Kingpin, @Stake
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.35/88 Institut Mines-Telecom R. Pacalet April 21, 2020
The first step: housing removal
Heat and cut...
and open... andrepair...
Source: Kingpin, @Stake
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.35/88 Institut Mines-Telecom R. Pacalet April 21, 2020
The first step: housing removal
Heat and cut...
and open... andrepair...
Source: Kingpin, @Stake
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.35/88 Institut Mines-Telecom R. Pacalet April 21, 2020
The first step: housing removal
Heat and cut... and open...
andrepair...
Source: Kingpin, @Stake
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.35/88 Institut Mines-Telecom R. Pacalet April 21, 2020
The first step: housing removal
Heat and cut... and open... andrepair...
Source: Kingpin, @Stake
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.35/88 Institut Mines-Telecom R. Pacalet April 21, 2020
The first step: housing removal
Heat and cut... and open... andrepair...
Source: Kingpin, @Stake
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.35/88 Institut Mines-Telecom R. Pacalet April 21, 2020
On board probing attacks
Critical components may be encapsulated but IO remain accessibleEven when deeply buried in multi-layer PCBs a track is much more vulnerable toprobing than on-chipWireless IO is even easier to monitorTest and other specific IO are at risk
Epoxy-encapsulated critical components Source: @Stake
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.36/88 Institut Mines-Telecom R. Pacalet April 21, 2020
On board probing attacks
Critical components may be encapsulated but IO remain accessibleEven when deeply buried in multi-layer PCBs a track is much more vulnerable toprobing than on-chipWireless IO is even easier to monitorTest and other specific IO are at risk
Epoxy-encapsulated critical components Source: @Stake
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.36/88 Institut Mines-Telecom R. Pacalet April 21, 2020
On board probing attacks
Critical components may be encapsulated but IO remain accessibleEven when deeply buried in multi-layer PCBs a track is much more vulnerable toprobing than on-chipWireless IO is even easier to monitorTest and other specific IO are at risk
Epoxy-encapsulated critical components Source: @Stake
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.36/88 Institut Mines-Telecom R. Pacalet April 21, 2020
On board probing attacks
Critical components may be encapsulated but IO remain accessibleEven when deeply buried in multi-layer PCBs a track is much more vulnerable toprobing than on-chipWireless IO is even easier to monitorTest and other specific IO are at risk
Epoxy-encapsulated critical components Source: @Stake
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.36/88 Institut Mines-Telecom R. Pacalet April 21, 2020
On board probing attacks
Critical components may be encapsulated but IO remain accessibleEven when deeply buried in multi-layer PCBs a track is much more vulnerable toprobing than on-chipWireless IO is even easier to monitorTest and other specific IO are at risk
Epoxy-encapsulated critical components Source: @Stake
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.36/88 Institut Mines-Telecom R. Pacalet April 21, 2020
On board probing attacks
Critical components may be encapsulated but IO remain accessibleEven when deeply buried in multi-layer PCBs a track is much more vulnerable toprobing than on-chipWireless IO is even easier to monitorTest and other specific IO are at risk
Epoxy-encapsulated critical components Source: @Stake
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.36/88 Institut Mines-Telecom R. Pacalet April 21, 2020
On-board probing
A lot of passive countermeasures• Make access to critical components more difficult• Remove identifiers from ICs• Use advanced packages (BGA)• Epoxy encapsulation• Remove test points• Obfuscate routing, route critical traces in inner layers, shorten traces• Increase frequency of busses
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.37/88 Institut Mines-Telecom R. Pacalet April 21, 2020
On-board probing
A lot of passive countermeasures• Make access to critical components more difficult• Remove identifiers from ICs• Use advanced packages (BGA)• Epoxy encapsulation• Remove test points• Obfuscate routing, route critical traces in inner layers, shorten traces• Increase frequency of busses
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.37/88 Institut Mines-Telecom R. Pacalet April 21, 2020
On-board probing
A lot of passive countermeasures• Make access to critical components more difficult• Remove identifiers from ICs• Use advanced packages (BGA)• Epoxy encapsulation• Remove test points• Obfuscate routing, route critical traces in inner layers, shorten traces• Increase frequency of busses
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.37/88 Institut Mines-Telecom R. Pacalet April 21, 2020
On-board probing
A lot of passive countermeasures• Make access to critical components more difficult• Remove identifiers from ICs• Use advanced packages (BGA)• Epoxy encapsulation• Remove test points• Obfuscate routing, route critical traces in inner layers, shorten traces• Increase frequency of busses
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.37/88 Institut Mines-Telecom R. Pacalet April 21, 2020
On-board probing
A lot of passive countermeasures• Make access to critical components more difficult• Remove identifiers from ICs• Use advanced packages (BGA)• Epoxy encapsulation• Remove test points• Obfuscate routing, route critical traces in inner layers, shorten traces• Increase frequency of busses
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.37/88 Institut Mines-Telecom R. Pacalet April 21, 2020
On-board probing
A lot of passive countermeasures• Make access to critical components more difficult• Remove identifiers from ICs• Use advanced packages (BGA)• Epoxy encapsulation• Remove test points• Obfuscate routing, route critical traces in inner layers, shorten traces• Increase frequency of busses
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.37/88 Institut Mines-Telecom R. Pacalet April 21, 2020
On-board probing
A lot of passive countermeasures• Make access to critical components more difficult• Remove identifiers from ICs• Use advanced packages (BGA)• Epoxy encapsulation• Remove test points• Obfuscate routing, route critical traces in inner layers, shorten traces• Increase frequency of busses
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.37/88 Institut Mines-Telecom R. Pacalet April 21, 2020
On-board probing
A lot of passive countermeasures• Make access to critical components more difficult• Remove identifiers from ICs• Use advanced packages (BGA)• Epoxy encapsulation• Remove test points• Obfuscate routing, route critical traces in inner layers, shorten traces• Increase frequency of busses
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.37/88 Institut Mines-Telecom R. Pacalet April 21, 2020
On-board probing
A lot of passive countermeasures• Make access to critical components more difficult• Remove identifiers from ICs• Use advanced packages (BGA)• Epoxy encapsulation• Remove test points• Obfuscate routing, route critical traces in inner layers, shorten traces• Increase frequency of busses
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.37/88 Institut Mines-Telecom R. Pacalet April 21, 2020
On-board probing: active countermeasures
Passive countermeasures cannot fully protect IOAlmost everything on board can be enciphered and integrity-checked in software...but the CPU memory busProtect CPU memory bus against
• On-board bus sniffing (confidentiality)• On-board bus injection (integrity)
Enciphering and/or integrity checking of CPU memory bus• Bodyguard of the memory bus
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.38/88 Institut Mines-Telecom R. Pacalet April 21, 2020
On-board probing: active countermeasures
Passive countermeasures cannot fully protect IOAlmost everything on board can be enciphered and integrity-checked in software...but the CPU memory busProtect CPU memory bus against
• On-board bus sniffing (confidentiality)• On-board bus injection (integrity)
Enciphering and/or integrity checking of CPU memory bus• Bodyguard of the memory bus
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.38/88 Institut Mines-Telecom R. Pacalet April 21, 2020
On-board probing: active countermeasures
Passive countermeasures cannot fully protect IOAlmost everything on board can be enciphered and integrity-checked in software...but the CPU memory busProtect CPU memory bus against
• On-board bus sniffing (confidentiality)• On-board bus injection (integrity)
Enciphering and/or integrity checking of CPU memory bus• Bodyguard of the memory bus
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.38/88 Institut Mines-Telecom R. Pacalet April 21, 2020
On-board probing: active countermeasures
Passive countermeasures cannot fully protect IOAlmost everything on board can be enciphered and integrity-checked in software...but the CPU memory busProtect CPU memory bus against
• On-board bus sniffing (confidentiality)• On-board bus injection (integrity)
Enciphering and/or integrity checking of CPU memory bus• Bodyguard of the memory bus
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.38/88 Institut Mines-Telecom R. Pacalet April 21, 2020
On-board probing: active countermeasures
Passive countermeasures cannot fully protect IOAlmost everything on board can be enciphered and integrity-checked in software...but the CPU memory busProtect CPU memory bus against
• On-board bus sniffing (confidentiality)• On-board bus injection (integrity)
Enciphering and/or integrity checking of CPU memory bus• Bodyguard of the memory bus
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.38/88 Institut Mines-Telecom R. Pacalet April 21, 2020
On-board probing: active countermeasures
Passive countermeasures cannot fully protect IOAlmost everything on board can be enciphered and integrity-checked in software...but the CPU memory busProtect CPU memory bus against
• On-board bus sniffing (confidentiality)• On-board bus injection (integrity)
Enciphering and/or integrity checking of CPU memory bus• Bodyguard of the memory bus
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.38/88 Institut Mines-Telecom R. Pacalet April 21, 2020
On-board probing: active countermeasures
Passive countermeasures cannot fully protect IOAlmost everything on board can be enciphered and integrity-checked in software...but the CPU memory busProtect CPU memory bus against
• On-board bus sniffing (confidentiality)• On-board bus injection (integrity)
Enciphering and/or integrity checking of CPU memory bus• Bodyguard of the memory bus
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.38/88 Institut Mines-Telecom R. Pacalet April 21, 2020
The memory bus bodyguard
Memory bus
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.39/88 Institut Mines-Telecom R. Pacalet April 21, 2020
The memory bus bodyguard
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.39/88 Institut Mines-Telecom R. Pacalet April 21, 2020
The memory bus bodyguard
Memory bus
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.39/88 Institut Mines-Telecom R. Pacalet April 21, 2020
The on-chip memory bus bodyguard
Inte
rcon
nect
Memorycontroller
CP
U#N
MMU
CP
U#1
MMU
$I
$D
$I
$D
Externalmemory
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.40/88 Institut Mines-Telecom R. Pacalet April 21, 2020
The on-chip memory bus bodyguard
Inte
rcon
nect
Memorycontroller
CP
U#N
MMU
CP
U#1
MMU
$I
$D
$I
$D
Externalmemory
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.40/88 Institut Mines-Telecom R. Pacalet April 21, 2020
On-board probing: active countermeasures
Based on a hardware on-chip memory bus bodyguardTwo different kinds of information to protect
• Read-only (write once, read many), like code or read-only data• Read-write data
Two different kinds of protection (four cases)• Confidentiality (yes / no)• Integrity (yes / no)
Depends on the security objectives and targetsPotential impact on cost / performances
Inte
rcon
nect
Memorycontroller
CP
U#N
MMU
CP
U#1
MMU
$I
$D
$I
$D
Externalmemory
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.41/88 Institut Mines-Telecom R. Pacalet April 21, 2020
On-board probing: active countermeasures
Based on a hardware on-chip memory bus bodyguardTwo different kinds of information to protect
• Read-only (write once, read many), like code or read-only data• Read-write data
Two different kinds of protection (four cases)• Confidentiality (yes / no)• Integrity (yes / no)
Depends on the security objectives and targetsPotential impact on cost / performances
Inte
rcon
nect
Memorycontroller
CP
U#N
MMU
CP
U#1
MMU
$I
$D
$I
$D
Externalmemory
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.41/88 Institut Mines-Telecom R. Pacalet April 21, 2020
On-board probing: active countermeasures
Based on a hardware on-chip memory bus bodyguardTwo different kinds of information to protect
• Read-only (write once, read many), like code or read-only data• Read-write data
Two different kinds of protection (four cases)• Confidentiality (yes / no)• Integrity (yes / no)
Depends on the security objectives and targetsPotential impact on cost / performances
Inte
rcon
nect
Memorycontroller
CP
U#N
MMU
CP
U#1
MMU
$I
$D
$I
$D
Externalmemory
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.41/88 Institut Mines-Telecom R. Pacalet April 21, 2020
On-board probing: active countermeasures
Based on a hardware on-chip memory bus bodyguardTwo different kinds of information to protect
• Read-only (write once, read many), like code or read-only data• Read-write data
Two different kinds of protection (four cases)• Confidentiality (yes / no)• Integrity (yes / no)
Depends on the security objectives and targetsPotential impact on cost / performances
Inte
rcon
nect
Memorycontroller
CP
U#N
MMU
CP
U#1
MMU
$I
$D
$I
$D
Externalmemory
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.41/88 Institut Mines-Telecom R. Pacalet April 21, 2020
On-board probing: active countermeasures
Based on a hardware on-chip memory bus bodyguardTwo different kinds of information to protect
• Read-only (write once, read many), like code or read-only data• Read-write data
Two different kinds of protection (four cases)• Confidentiality (yes / no)• Integrity (yes / no)
Depends on the security objectives and targetsPotential impact on cost / performances
Inte
rcon
nect
Memorycontroller
CP
U#N
MMU
CP
U#1
MMU
$I
$D
$I
$D
Externalmemory
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.41/88 Institut Mines-Telecom R. Pacalet April 21, 2020
On-board probing: active countermeasures
Based on a hardware on-chip memory bus bodyguardTwo different kinds of information to protect
• Read-only (write once, read many), like code or read-only data• Read-write data
Two different kinds of protection (four cases)• Confidentiality (yes / no)• Integrity (yes / no)
Depends on the security objectives and targetsPotential impact on cost / performances
Inte
rcon
nect
Memorycontroller
CP
U#N
MMU
CP
U#1
MMU
$I
$D
$I
$D
Externalmemory
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.41/88 Institut Mines-Telecom R. Pacalet April 21, 2020
On-board probing: active countermeasures
Based on a hardware on-chip memory bus bodyguardTwo different kinds of information to protect
• Read-only (write once, read many), like code or read-only data• Read-write data
Two different kinds of protection (four cases)• Confidentiality (yes / no)• Integrity (yes / no)
Depends on the security objectives and targetsPotential impact on cost / performances
Inte
rcon
nect
Memorycontroller
CP
U#N
MMU
CP
U#1
MMU
$I
$D
$I
$D
Externalmemory
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.41/88 Institut Mines-Telecom R. Pacalet April 21, 2020
On-board probing: active countermeasures
Based on a hardware on-chip memory bus bodyguardTwo different kinds of information to protect
• Read-only (write once, read many), like code or read-only data• Read-write data
Two different kinds of protection (four cases)• Confidentiality (yes / no)• Integrity (yes / no)
Depends on the security objectives and targetsPotential impact on cost / performances
Inte
rcon
nect
Memorycontroller
CP
U#N
MMU
CP
U#1
MMU
$I
$D
$I
$D
Externalmemory
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.41/88 Institut Mines-Telecom R. Pacalet April 21, 2020
On-board probing: active countermeasures
Based on a hardware on-chip memory bus bodyguardTwo different kinds of information to protect
• Read-only (write once, read many), like code or read-only data• Read-write data
Two different kinds of protection (four cases)• Confidentiality (yes / no)• Integrity (yes / no)
Depends on the security objectives and targetsPotential impact on cost / performances
Inte
rcon
nect
Memorycontroller
CP
U#N
MMU
CP
U#1
MMU
$I
$D
$I
$D
Externalmemory
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.41/88 Institut Mines-Telecom R. Pacalet April 21, 2020
On-board probing: active countermeasures
Based on a hardware on-chip memory bus bodyguardTwo different kinds of information to protect
• Read-only (write once, read many), like code or read-only data• Read-write data
Two different kinds of protection (four cases)• Confidentiality (yes / no)• Integrity (yes / no)
Depends on the security objectives and targetsPotential impact on cost / performances
Inte
rcon
nect
Memorycontroller
CP
U#N
MMU
CP
U#1
MMU
$I
$D
$I
$D
Externalmemory
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.41/88 Institut Mines-Telecom R. Pacalet April 21, 2020
On-board probing: active countermeasures
Enciphering and/or integrity checking of CPU memory bus• Potential (huge) impact on cost / performances• Depends on the security objectives and targets• Some of this is used in XBox 360 (but not 100% efficiently)
Autonomous bodyguard• Simple and efficient• Monolithic protection• Of whole or fixed parts of memory• Not flexible• Systematic performance degradation
Inte
rcon
nect
Memorycontroller
CP
U#N
MMU
CP
U#1
MMU
$I
$D
$I
$D
Externalmemory
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.42/88 Institut Mines-Telecom R. Pacalet April 21, 2020
On-board probing: active countermeasures
Enciphering and/or integrity checking of CPU memory bus• Potential (huge) impact on cost / performances• Depends on the security objectives and targets• Some of this is used in XBox 360 (but not 100% efficiently)
Autonomous bodyguard• Simple and efficient• Monolithic protection• Of whole or fixed parts of memory• Not flexible• Systematic performance degradation
Inte
rcon
nect
Memorycontroller
CP
U#N
MMU
CP
U#1
MMU
$I
$D
$I
$D
Externalmemory
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.42/88 Institut Mines-Telecom R. Pacalet April 21, 2020
On-board probing: active countermeasures
Enciphering and/or integrity checking of CPU memory bus• Potential (huge) impact on cost / performances• Depends on the security objectives and targets• Some of this is used in XBox 360 (but not 100% efficiently)
Autonomous bodyguard• Simple and efficient• Monolithic protection• Of whole or fixed parts of memory• Not flexible• Systematic performance degradation
Inte
rcon
nect
Memorycontroller
CP
U#N
MMU
CP
U#1
MMU
$I
$D
$I
$D
Externalmemory
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.42/88 Institut Mines-Telecom R. Pacalet April 21, 2020
On-board probing: active countermeasures
Enciphering and/or integrity checking of CPU memory bus• Potential (huge) impact on cost / performances• Depends on the security objectives and targets• Some of this is used in XBox 360 (but not 100% efficiently)
Autonomous bodyguard• Simple and efficient• Monolithic protection• Of whole or fixed parts of memory• Not flexible• Systematic performance degradation
Inte
rcon
nect
Memorycontroller
CP
U#N
MMU
CP
U#1
MMU
$I
$D
$I
$D
Externalmemory
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.42/88 Institut Mines-Telecom R. Pacalet April 21, 2020
On-board probing: active countermeasures
Enciphering and/or integrity checking of CPU memory bus• Potential (huge) impact on cost / performances• Depends on the security objectives and targets• Some of this is used in XBox 360 (but not 100% efficiently)
Autonomous bodyguard• Simple and efficient• Monolithic protection• Of whole or fixed parts of memory• Not flexible• Systematic performance degradation
Inte
rcon
nect
Memorycontroller
CP
U#N
MMU
CP
U#1
MMU
$I
$D
$I
$D
Externalmemory
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.42/88 Institut Mines-Telecom R. Pacalet April 21, 2020
On-board probing: active countermeasures
Enciphering and/or integrity checking of CPU memory bus• Potential (huge) impact on cost / performances• Depends on the security objectives and targets• Some of this is used in XBox 360 (but not 100% efficiently)
Autonomous bodyguard• Simple and efficient• Monolithic protection• Of whole or fixed parts of memory• Not flexible• Systematic performance degradation
Inte
rcon
nect
Memorycontroller
CP
U#N
MMU
CP
U#1
MMU
$I
$D
$I
$D
Externalmemory
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.42/88 Institut Mines-Telecom R. Pacalet April 21, 2020
On-board probing: active countermeasures
Enciphering and/or integrity checking of CPU memory bus• Potential (huge) impact on cost / performances• Depends on the security objectives and targets• Some of this is used in XBox 360 (but not 100% efficiently)
Autonomous bodyguard• Simple and efficient• Monolithic protection• Of whole or fixed parts of memory• Not flexible• Systematic performance degradation
Inte
rcon
nect
Memorycontroller
CP
U#N
MMU
CP
U#1
MMU
$I
$D
$I
$D
Externalmemory
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.42/88 Institut Mines-Telecom R. Pacalet April 21, 2020
On-board probing: active countermeasures
Enciphering and/or integrity checking of CPU memory bus• Potential (huge) impact on cost / performances• Depends on the security objectives and targets• Some of this is used in XBox 360 (but not 100% efficiently)
Autonomous bodyguard• Simple and efficient• Monolithic protection• Of whole or fixed parts of memory• Not flexible• Systematic performance degradation
Inte
rcon
nect
Memorycontroller
CP
U#N
MMU
CP
U#1
MMU
$I
$D
$I
$D
Externalmemory
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.42/88 Institut Mines-Telecom R. Pacalet April 21, 2020
On-board probing: active countermeasures
Enciphering and/or integrity checking of CPU memory bus• Potential (huge) impact on cost / performances• Depends on the security objectives and targets• Some of this is used in XBox 360 (but not 100% efficiently)
Autonomous bodyguard• Simple and efficient• Monolithic protection• Of whole or fixed parts of memory• Not flexible• Systematic performance degradation
Inte
rcon
nect
Memorycontroller
CP
U#N
MMU
CP
U#1
MMU
$I
$D
$I
$D
Externalmemory
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.42/88 Institut Mines-Telecom R. Pacalet April 21, 2020
On-board probing: active countermeasures
Enciphering and/or integrity checking of CPU memory bus• Potential (huge) impact on cost / performances• Depends on the security objectives and targets• Some of this is used in XBox 360 (but not 100% efficiently)
Autonomous bodyguard• Simple and efficient• Monolithic protection• Of whole or fixed parts of memory• Not flexible• Systematic performance degradation
Inte
rcon
nect
Memorycontroller
CP
U#N
MMU
CP
U#1
MMU
$I
$D
$I
$D
Externalmemory
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.42/88 Institut Mines-Telecom R. Pacalet April 21, 2020
On-board probing: active countermeasures
Enciphering and/or integrity checking of CPU memory bus• Potential (huge) impact on cost / performances• Depends on the security objectives and targets• Some of this is used in XBox 360 (but not 100% efficiently)
Autonomous bodyguard• Simple and efficient• Monolithic protection• Of whole or fixed parts of memory• Not flexible• Systematic performance degradation
Inte
rcon
nect
Memorycontroller
CP
U#N
MMU
CP
U#1
MMU
$I
$D
$I
$D
Externalmemory
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.42/88 Institut Mines-Telecom R. Pacalet April 21, 2020
On-board probing: active countermeasures
Enciphering and/or integrity checking of CPU memory bus• Potential (huge) impact on cost / performances• Depends on the security objectives and targets• Some of this is used in XBox 360 (but not 100% efficiently)
Autonomous bodyguard• Simple and efficient• Monolithic protection• Of whole or fixed parts of memory• Not flexible• Systematic performance degradation
Inte
rcon
nect
Memorycontroller
CP
U#N
MMU
CP
U#1
MMU
$I
$D
$I
$D
Externalmemory
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.42/88 Institut Mines-Telecom R. Pacalet April 21, 2020
On-board probing: active countermeasures
Enciphering and/or integrity checking of CPU memory bus• Potential (huge) impact on cost / performances• Depends on the security objectives and targets• Some of this is used in XBox 360 (but not 100% efficiently)
Autonomous bodyguard• Simple and efficient• Monolithic protection• Of whole or fixed parts of memory• Not flexible• Systematic performance degradation
Inte
rcon
nect
Memorycontroller
CP
U#N
MMU
CP
U#1
MMU
$I
$D
$I
$D
Externalmemory
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.42/88 Institut Mines-Telecom R. Pacalet April 21, 2020
On-board probing: active countermeasures
Software-assisted bodyguard (Software Security Manager)• Flexible and efficient
– Fine-grain (memory page) protection– Differentiated security policies
• Minimize performance impact• Complex• Must avoid software exploits against SSM
– Tiny and simple (fewer bugs)– Deeply verified, maybe formally proven (the must)– Integrated with virtualization hyper visor, micro-kernel, TrustZone® monitor, ...
Inte
rcon
nect
Memorycontroller
CP
U#N
MMU
CP
U#1
MMU
$I
$D
$I
$D
Externalmemory
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.43/88 Institut Mines-Telecom R. Pacalet April 21, 2020
On-board probing: active countermeasures
Software-assisted bodyguard (Software Security Manager)• Flexible and efficient
– Fine-grain (memory page) protection– Differentiated security policies
• Minimize performance impact• Complex• Must avoid software exploits against SSM
– Tiny and simple (fewer bugs)– Deeply verified, maybe formally proven (the must)– Integrated with virtualization hyper visor, micro-kernel, TrustZone® monitor, ...
Inte
rcon
nect
Memorycontroller
CP
U#N
MMU
CP
U#1
MMU
$I
$D
$I
$D
Externalmemory
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.43/88 Institut Mines-Telecom R. Pacalet April 21, 2020
On-board probing: active countermeasures
Software-assisted bodyguard (Software Security Manager)• Flexible and efficient
– Fine-grain (memory page) protection– Differentiated security policies
• Minimize performance impact• Complex• Must avoid software exploits against SSM
– Tiny and simple (fewer bugs)– Deeply verified, maybe formally proven (the must)– Integrated with virtualization hyper visor, micro-kernel, TrustZone® monitor, ...
Inte
rcon
nect
Memorycontroller
CP
U#N
MMU
CP
U#1
MMU
$I
$D
$I
$D
Externalmemory
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.43/88 Institut Mines-Telecom R. Pacalet April 21, 2020
On-board probing: active countermeasures
Software-assisted bodyguard (Software Security Manager)• Flexible and efficient
– Fine-grain (memory page) protection– Differentiated security policies
• Minimize performance impact• Complex• Must avoid software exploits against SSM
– Tiny and simple (fewer bugs)– Deeply verified, maybe formally proven (the must)– Integrated with virtualization hyper visor, micro-kernel, TrustZone® monitor, ...
Inte
rcon
nect
Memorycontroller
CP
U#N
MMU
CP
U#1
MMU
$I
$D
$I
$D
Externalmemory
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.43/88 Institut Mines-Telecom R. Pacalet April 21, 2020
On-board probing: active countermeasures
Software-assisted bodyguard (Software Security Manager)• Flexible and efficient
– Fine-grain (memory page) protection– Differentiated security policies
• Minimize performance impact• Complex• Must avoid software exploits against SSM
– Tiny and simple (fewer bugs)– Deeply verified, maybe formally proven (the must)– Integrated with virtualization hyper visor, micro-kernel, TrustZone® monitor, ...
Inte
rcon
nect
Memorycontroller
CP
U#N
MMU
CP
U#1
MMU
$I
$D
$I
$D
Externalmemory
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.43/88 Institut Mines-Telecom R. Pacalet April 21, 2020
On-board probing: active countermeasures
Software-assisted bodyguard (Software Security Manager)• Flexible and efficient
– Fine-grain (memory page) protection– Differentiated security policies
• Minimize performance impact• Complex• Must avoid software exploits against SSM
– Tiny and simple (fewer bugs)– Deeply verified, maybe formally proven (the must)– Integrated with virtualization hyper visor, micro-kernel, TrustZone® monitor, ...
Inte
rcon
nect
Memorycontroller
CP
U#N
MMU
CP
U#1
MMU
$I
$D
$I
$D
Externalmemory
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.43/88 Institut Mines-Telecom R. Pacalet April 21, 2020
On-board probing: active countermeasures
Software-assisted bodyguard (Software Security Manager)• Flexible and efficient
– Fine-grain (memory page) protection– Differentiated security policies
• Minimize performance impact• Complex• Must avoid software exploits against SSM
– Tiny and simple (fewer bugs)– Deeply verified, maybe formally proven (the must)– Integrated with virtualization hyper visor, micro-kernel, TrustZone® monitor, ...
Inte
rcon
nect
Memorycontroller
CP
U#N
MMU
CP
U#1
MMU
$I
$D
$I
$D
Externalmemory
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.43/88 Institut Mines-Telecom R. Pacalet April 21, 2020
On-board probing: active countermeasures
Software-assisted bodyguard (Software Security Manager)• Flexible and efficient
– Fine-grain (memory page) protection– Differentiated security policies
• Minimize performance impact• Complex• Must avoid software exploits against SSM
– Tiny and simple (fewer bugs)– Deeply verified, maybe formally proven (the must)– Integrated with virtualization hyper visor, micro-kernel, TrustZone® monitor, ...
Inte
rcon
nect
Memorycontroller
CP
U#N
MMU
CP
U#1
MMU
$I
$D
$I
$D
Externalmemory
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.43/88 Institut Mines-Telecom R. Pacalet April 21, 2020
On-board probing: active countermeasures
Software-assisted bodyguard (Software Security Manager)• Flexible and efficient
– Fine-grain (memory page) protection– Differentiated security policies
• Minimize performance impact• Complex• Must avoid software exploits against SSM
– Tiny and simple (fewer bugs)– Deeply verified, maybe formally proven (the must)– Integrated with virtualization hyper visor, micro-kernel, TrustZone® monitor, ...
Inte
rcon
nect
Memorycontroller
CP
U#N
MMU
CP
U#1
MMU
$I
$D
$I
$D
Externalmemory
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.43/88 Institut Mines-Telecom R. Pacalet April 21, 2020
On-board probing: active countermeasures
Software-assisted bodyguard (Software Security Manager)• Flexible and efficient
– Fine-grain (memory page) protection– Differentiated security policies
• Minimize performance impact• Complex• Must avoid software exploits against SSM
– Tiny and simple (fewer bugs)– Deeply verified, maybe formally proven (the must)– Integrated with virtualization hyper visor, micro-kernel, TrustZone® monitor, ...
Inte
rcon
nect
Memorycontroller
CP
U#N
MMU
CP
U#1
MMU
$I
$D
$I
$D
Externalmemory
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.43/88 Institut Mines-Telecom R. Pacalet April 21, 2020
On-board probing: active countermeasures
Software-assisted bodyguard (Software Security Manager)• Flexible and efficient
– Fine-grain (memory page) protection– Differentiated security policies
• Minimize performance impact• Complex• Must avoid software exploits against SSM
– Tiny and simple (fewer bugs)– Deeply verified, maybe formally proven (the must)– Integrated with virtualization hyper visor, micro-kernel, TrustZone® monitor, ...
Inte
rcon
nect
Memorycontroller
CP
U#N
MMU
CP
U#1
MMU
$I
$D
$I
$D
Externalmemory
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.43/88 Institut Mines-Telecom R. Pacalet April 21, 2020
On-board probing: active countermeasures
Software-assisted bodyguard (Software Security Manager)• Flexible and efficient
– Fine-grain (memory page) protection– Differentiated security policies
• Minimize performance impact• Complex• Must avoid software exploits against SSM
– Tiny and simple (fewer bugs)– Deeply verified, maybe formally proven (the must)– Integrated with virtualization hyper visor, micro-kernel, TrustZone® monitor, ...
Inte
rcon
nect
Memorycontroller
CP
U#N
MMU
CP
U#1
MMU
$I
$D
$I
$D
Externalmemory
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.43/88 Institut Mines-Telecom R. Pacalet April 21, 2020
On-board probing: active countermeasures
Software-assisted bodyguard (Software Security Manager)• Flexible and efficient
– Fine-grain (memory page) protection– Differentiated security policies
• Minimize performance impact• Complex• Must avoid software exploits against SSM
– Tiny and simple (fewer bugs)– Deeply verified, maybe formally proven (the must)– Integrated with virtualization hyper visor, micro-kernel, TrustZone® monitor, ...
Inte
rcon
nect
Memorycontroller
CP
U#N
MMU
CP
U#1
MMU
$I
$D
$I
$D
Externalmemory
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.43/88 Institut Mines-Telecom R. Pacalet April 21, 2020
On-board probing attacks / Code enciphering
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.44/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Code enciphering
Proposed by Robert M. Best in 1977 (patented)Frequently claimed security goals:
• Protect embedded Industrial Property (IP): an attacker probing the bus between a CPUand its external memory cannot recover IP
• Global system obfuscation: an attacker, whatever her goals are, cannot understand thesystem
• Integrity: an attacker cannot induce her own code to gain privileged access to the system
Principles:• Off-line enciphering (once), on the fly deciphering (many)• Simple on systems that do not update their embedded software• Software update still possible but a bit more complex• Note: read-only data can be handled the same way
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.45/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Code enciphering
Proposed by Robert M. Best in 1977 (patented)Frequently claimed security goals:
• Protect embedded Industrial Property (IP): an attacker probing the bus between a CPUand its external memory cannot recover IP
• Global system obfuscation: an attacker, whatever her goals are, cannot understand thesystem
• Integrity: an attacker cannot induce her own code to gain privileged access to the system
Principles:• Off-line enciphering (once), on the fly deciphering (many)• Simple on systems that do not update their embedded software• Software update still possible but a bit more complex• Note: read-only data can be handled the same way
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.45/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Code enciphering
Proposed by Robert M. Best in 1977 (patented)Frequently claimed security goals:
• Protect embedded Industrial Property (IP): an attacker probing the bus between a CPUand its external memory cannot recover IP
• Global system obfuscation: an attacker, whatever her goals are, cannot understand thesystem
• Integrity: an attacker cannot induce her own code to gain privileged access to the system
Principles:• Off-line enciphering (once), on the fly deciphering (many)• Simple on systems that do not update their embedded software• Software update still possible but a bit more complex• Note: read-only data can be handled the same way
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.45/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Code enciphering
Proposed by Robert M. Best in 1977 (patented)Frequently claimed security goals:
• Protect embedded Industrial Property (IP): an attacker probing the bus between a CPUand its external memory cannot recover IP
• Global system obfuscation: an attacker, whatever her goals are, cannot understand thesystem
• Integrity: an attacker cannot induce her own code to gain privileged access to the system
Principles:• Off-line enciphering (once), on the fly deciphering (many)• Simple on systems that do not update their embedded software• Software update still possible but a bit more complex• Note: read-only data can be handled the same way
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.45/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Code enciphering
Proposed by Robert M. Best in 1977 (patented)Frequently claimed security goals:
• Protect embedded Industrial Property (IP): an attacker probing the bus between a CPUand its external memory cannot recover IP
• Global system obfuscation: an attacker, whatever her goals are, cannot understand thesystem
• Integrity: an attacker cannot induce her own code to gain privileged access to the system
Principles:• Off-line enciphering (once), on the fly deciphering (many)• Simple on systems that do not update their embedded software• Software update still possible but a bit more complex• Note: read-only data can be handled the same way
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.45/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Code enciphering
Proposed by Robert M. Best in 1977 (patented)Frequently claimed security goals:
• Protect embedded Industrial Property (IP): an attacker probing the bus between a CPUand its external memory cannot recover IP
• Global system obfuscation: an attacker, whatever her goals are, cannot understand thesystem
• Integrity: an attacker cannot induce her own code to gain privileged access to the system
Principles:• Off-line enciphering (once), on the fly deciphering (many)• Simple on systems that do not update their embedded software• Software update still possible but a bit more complex• Note: read-only data can be handled the same way
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.45/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Code enciphering
Proposed by Robert M. Best in 1977 (patented)Frequently claimed security goals:
• Protect embedded Industrial Property (IP): an attacker probing the bus between a CPUand its external memory cannot recover IP
• Global system obfuscation: an attacker, whatever her goals are, cannot understand thesystem
• Integrity: an attacker cannot induce her own code to gain privileged access to the system
Principles:• Off-line enciphering (once), on the fly deciphering (many)• Simple on systems that do not update their embedded software• Software update still possible but a bit more complex• Note: read-only data can be handled the same way
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.45/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Code enciphering
Proposed by Robert M. Best in 1977 (patented)Frequently claimed security goals:
• Protect embedded Industrial Property (IP): an attacker probing the bus between a CPUand its external memory cannot recover IP
• Global system obfuscation: an attacker, whatever her goals are, cannot understand thesystem
• Integrity: an attacker cannot induce her own code to gain privileged access to the system
Principles:• Off-line enciphering (once), on the fly deciphering (many)• Simple on systems that do not update their embedded software• Software update still possible but a bit more complex• Note: read-only data can be handled the same way
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.45/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Code enciphering
Proposed by Robert M. Best in 1977 (patented)Frequently claimed security goals:
• Protect embedded Industrial Property (IP): an attacker probing the bus between a CPUand its external memory cannot recover IP
• Global system obfuscation: an attacker, whatever her goals are, cannot understand thesystem
• Integrity: an attacker cannot induce her own code to gain privileged access to the system
Principles:• Off-line enciphering (once), on the fly deciphering (many)• Simple on systems that do not update their embedded software• Software update still possible but a bit more complex• Note: read-only data can be handled the same way
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.45/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Code enciphering
Proposed by Robert M. Best in 1977 (patented)Frequently claimed security goals:
• Protect embedded Industrial Property (IP): an attacker probing the bus between a CPUand its external memory cannot recover IP
• Global system obfuscation: an attacker, whatever her goals are, cannot understand thesystem
• Integrity: an attacker cannot induce her own code to gain privileged access to the system
Principles:• Off-line enciphering (once), on the fly deciphering (many)• Simple on systems that do not update their embedded software• Software update still possible but a bit more complex• Note: read-only data can be handled the same way
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.45/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Code enciphering
Programs are enciphered off line and stored in external memoryBodyguard deciphers programs on-the-flyInstructions are cached in plain text form
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.46/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Code enciphering
Programs are enciphered off line and stored in external memoryBodyguard deciphers programs on-the-flyInstructions are cached in plain text form
Code
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.46/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Code enciphering
Programs are enciphered off line and stored in external memoryBodyguard deciphers programs on-the-flyInstructions are cached in plain text form
Off-line enciphering
Key E
Code
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.46/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Code enciphering
Programs are enciphered off line and stored in external memoryBodyguard deciphers programs on-the-flyInstructions are cached in plain text form
Off-line enciphering
Key E
Code
Code
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.46/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Code enciphering
Programs are enciphered off line and stored in external memoryBodyguard deciphers programs on-the-flyInstructions are cached in plain text form
Externalmemory
EKey
Off-line enciphering
Code
Code
Code
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.46/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Code enciphering
Programs are enciphered off line and stored in external memoryBodyguard deciphers programs on-the-flyInstructions are cached in plain text form
Externalmemory
EKey
Off-line enciphering
Code
Code
Code
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.46/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Code enciphering
Programs are enciphered off line and stored in external memoryBodyguard deciphers programs on-the-flyInstructions are cached in plain text form
Inte
rcon
nect
Memorycontroller
CP
U#N
MMU
CP
U#1
MMU
$I
$D
$I
$D Key E
Externalmemory
Off-line enciphering
Code
Code
Code
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.46/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Code enciphering
Programs are enciphered off line and stored in external memoryBodyguard deciphers programs on-the-flyInstructions are cached in plain text form
Inte
rcon
nect
Memorycontroller
Externalmemory
CP
U#N
MMU
CP
U#1
MMU
$I
$D
$I
$D
Off-line enciphering
Key E
Code
Code
Code
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.46/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Code enciphering
Programs are enciphered off line and stored in external memoryBodyguard deciphers programs on-the-flyInstructions are cached in plain text form
Inte
rcon
nect
Memorycontroller
Externalmemory
CP
U#N
MMU
CP
U#1
MMU
$I
$D
$I
$D
Off-line enciphering
Key E
On-the-fly deciphering
Code
Code
Code
Key
D
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.46/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Code enciphering
Programs are enciphered off line and stored in external memoryBodyguard deciphers programs on-the-flyInstructions are cached in plain text form
Inte
rcon
nect
Memorycontroller
Externalmemory
CP
U#N
MMU
CP
U#1
MMU
$I
$D
$I
$D
Off-line enciphering
Key E
On-the-fly deciphering
Code
Code
Code
Key
D
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.46/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Code enciphering
Programs are enciphered off line and stored in external memoryBodyguard deciphers programs on-the-flyInstructions are cached in plain text form
Inte
rcon
nect
Memorycontroller
Externalmemory
CP
U#N
MMU
CP
U#1
MMU
$I
$D
$I
$D
Off-line enciphering
Key E
On-the-fly deciphering
Key
Code
Code
Code
D
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.46/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Code enciphering
Actual security properties vs. claimed security goals• Protect embedded IP: almost (code only)
– As long as the secret key is protected– As long as a dictionary attack remains infeasible
• Global system obfuscation: almost (code only)– As long as the secret key is protected– As long as a dictionary attack remains infeasible
• Integrity: no– Any enciphered instruction can be replaced by any other, anytime– Data are completely unprotected
Performance• No penalty until instruction cache miss• Cost of instruction cache misses increased by deciphering latency• Embedded deciphering function ⇒silicon area and power
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.47/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Code enciphering
Actual security properties vs. claimed security goals• Protect embedded IP: almost (code only)
– As long as the secret key is protected– As long as a dictionary attack remains infeasible
• Global system obfuscation: almost (code only)– As long as the secret key is protected– As long as a dictionary attack remains infeasible
• Integrity: no– Any enciphered instruction can be replaced by any other, anytime– Data are completely unprotected
Performance• No penalty until instruction cache miss• Cost of instruction cache misses increased by deciphering latency• Embedded deciphering function ⇒silicon area and power
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.47/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Code enciphering
Actual security properties vs. claimed security goals• Protect embedded IP: almost (code only)
– As long as the secret key is protected– As long as a dictionary attack remains infeasible
• Global system obfuscation: almost (code only)– As long as the secret key is protected– As long as a dictionary attack remains infeasible
• Integrity: no– Any enciphered instruction can be replaced by any other, anytime– Data are completely unprotected
Performance• No penalty until instruction cache miss• Cost of instruction cache misses increased by deciphering latency• Embedded deciphering function ⇒silicon area and power
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.47/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Code enciphering
Actual security properties vs. claimed security goals• Protect embedded IP: almost (code only)
– As long as the secret key is protected– As long as a dictionary attack remains infeasible
• Global system obfuscation: almost (code only)– As long as the secret key is protected– As long as a dictionary attack remains infeasible
• Integrity: no– Any enciphered instruction can be replaced by any other, anytime– Data are completely unprotected
Performance• No penalty until instruction cache miss• Cost of instruction cache misses increased by deciphering latency• Embedded deciphering function ⇒silicon area and power
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.47/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Code enciphering
Actual security properties vs. claimed security goals• Protect embedded IP: almost (code only)
– As long as the secret key is protected– As long as a dictionary attack remains infeasible
• Global system obfuscation: almost (code only)– As long as the secret key is protected– As long as a dictionary attack remains infeasible
• Integrity: no– Any enciphered instruction can be replaced by any other, anytime– Data are completely unprotected
Performance• No penalty until instruction cache miss• Cost of instruction cache misses increased by deciphering latency• Embedded deciphering function ⇒silicon area and power
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.47/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Code enciphering
Actual security properties vs. claimed security goals• Protect embedded IP: almost (code only)
– As long as the secret key is protected– As long as a dictionary attack remains infeasible
• Global system obfuscation: almost (code only)– As long as the secret key is protected– As long as a dictionary attack remains infeasible
• Integrity: no– Any enciphered instruction can be replaced by any other, anytime– Data are completely unprotected
Performance• No penalty until instruction cache miss• Cost of instruction cache misses increased by deciphering latency• Embedded deciphering function ⇒silicon area and power
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.47/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Code enciphering
Actual security properties vs. claimed security goals• Protect embedded IP: almost (code only)
– As long as the secret key is protected– As long as a dictionary attack remains infeasible
• Global system obfuscation: almost (code only)– As long as the secret key is protected– As long as a dictionary attack remains infeasible
• Integrity: no– Any enciphered instruction can be replaced by any other, anytime– Data are completely unprotected
Performance• No penalty until instruction cache miss• Cost of instruction cache misses increased by deciphering latency• Embedded deciphering function ⇒silicon area and power
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.47/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Code enciphering
Actual security properties vs. claimed security goals• Protect embedded IP: almost (code only)
– As long as the secret key is protected– As long as a dictionary attack remains infeasible
• Global system obfuscation: almost (code only)– As long as the secret key is protected– As long as a dictionary attack remains infeasible
• Integrity: no– Any enciphered instruction can be replaced by any other, anytime– Data are completely unprotected
Performance• No penalty until instruction cache miss• Cost of instruction cache misses increased by deciphering latency• Embedded deciphering function ⇒silicon area and power
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.47/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Code enciphering
Actual security properties vs. claimed security goals• Protect embedded IP: almost (code only)
– As long as the secret key is protected– As long as a dictionary attack remains infeasible
• Global system obfuscation: almost (code only)– As long as the secret key is protected– As long as a dictionary attack remains infeasible
• Integrity: no– Any enciphered instruction can be replaced by any other, anytime– Data are completely unprotected
Performance• No penalty until instruction cache miss• Cost of instruction cache misses increased by deciphering latency• Embedded deciphering function ⇒silicon area and power
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.47/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Code enciphering
Actual security properties vs. claimed security goals• Protect embedded IP: almost (code only)
– As long as the secret key is protected– As long as a dictionary attack remains infeasible
• Global system obfuscation: almost (code only)– As long as the secret key is protected– As long as a dictionary attack remains infeasible
• Integrity: no– Any enciphered instruction can be replaced by any other, anytime– Data are completely unprotected
Performance• No penalty until instruction cache miss• Cost of instruction cache misses increased by deciphering latency• Embedded deciphering function ⇒silicon area and power
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.47/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Code enciphering
Actual security properties vs. claimed security goals• Protect embedded IP: almost (code only)
– As long as the secret key is protected– As long as a dictionary attack remains infeasible
• Global system obfuscation: almost (code only)– As long as the secret key is protected– As long as a dictionary attack remains infeasible
• Integrity: no– Any enciphered instruction can be replaced by any other, anytime– Data are completely unprotected
Performance• No penalty until instruction cache miss• Cost of instruction cache misses increased by deciphering latency• Embedded deciphering function ⇒silicon area and power
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.47/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Code enciphering
Actual security properties vs. claimed security goals• Protect embedded IP: almost (code only)
– As long as the secret key is protected– As long as a dictionary attack remains infeasible
• Global system obfuscation: almost (code only)– As long as the secret key is protected– As long as a dictionary attack remains infeasible
• Integrity: no– Any enciphered instruction can be replaced by any other, anytime– Data are completely unprotected
Performance• No penalty until instruction cache miss• Cost of instruction cache misses increased by deciphering latency• Embedded deciphering function ⇒silicon area and power
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.47/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Code enciphering
Actual security properties vs. claimed security goals• Protect embedded IP: almost (code only)
– As long as the secret key is protected– As long as a dictionary attack remains infeasible
• Global system obfuscation: almost (code only)– As long as the secret key is protected– As long as a dictionary attack remains infeasible
• Integrity: no– Any enciphered instruction can be replaced by any other, anytime– Data are completely unprotected
Performance• No penalty until instruction cache miss• Cost of instruction cache misses increased by deciphering latency• Embedded deciphering function ⇒silicon area and power
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.47/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Code enciphering
Actual security properties vs. claimed security goals• Protect embedded IP: almost (code only)
– As long as the secret key is protected– As long as a dictionary attack remains infeasible
• Global system obfuscation: almost (code only)– As long as the secret key is protected– As long as a dictionary attack remains infeasible
• Integrity: no– Any enciphered instruction can be replaced by any other, anytime– Data are completely unprotected
Performance• No penalty until instruction cache miss• Cost of instruction cache misses increased by deciphering latency• Embedded deciphering function ⇒silicon area and power
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.47/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Code enciphering: performance
Deciphering cannot start before the read enciphered instruction is back from externalmemory
• Overall latency = external memory latency plus deciphering latency
? How could we start the deciphering before the instruction is available?✓ Compute some seed from the secret key and the address issued by the CPU✓ Ultra-fast deciphering function that uses the seed (⊕)
If external memory latency ≥ seed computation latency ⇒no performancedegradation even on cache misses
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.48/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Code enciphering: performance
Deciphering cannot start before the read enciphered instruction is back from externalmemory
• Overall latency = external memory latency plus deciphering latency
? How could we start the deciphering before the instruction is available?✓ Compute some seed from the secret key and the address issued by the CPU✓ Ultra-fast deciphering function that uses the seed (⊕)
If external memory latency ≥ seed computation latency ⇒no performancedegradation even on cache misses
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.48/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Code enciphering: performance
Deciphering cannot start before the read enciphered instruction is back from externalmemory
• Overall latency = external memory latency plus deciphering latency
? How could we start the deciphering before the instruction is available?✓ Compute some seed from the secret key and the address issued by the CPU✓ Ultra-fast deciphering function that uses the seed (⊕)
If external memory latency ≥ seed computation latency ⇒no performancedegradation even on cache misses
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.48/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Code enciphering: performance
Deciphering cannot start before the read enciphered instruction is back from externalmemory
• Overall latency = external memory latency plus deciphering latency
? How could we start the deciphering before the instruction is available?✓ Compute some seed from the secret key and the address issued by the CPU✓ Ultra-fast deciphering function that uses the seed (⊕)
If external memory latency ≥ seed computation latency ⇒no performancedegradation even on cache misses
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.48/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Code enciphering: performance
Deciphering cannot start before the read enciphered instruction is back from externalmemory
• Overall latency = external memory latency plus deciphering latency
? How could we start the deciphering before the instruction is available?✓ Compute some seed from the secret key and the address issued by the CPU✓ Ultra-fast deciphering function that uses the seed (⊕)
If external memory latency ≥ seed computation latency ⇒no performancedegradation even on cache misses
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.48/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Code enciphering: performance
Deciphering cannot start before the read enciphered instruction is back from externalmemory
• Overall latency = external memory latency plus deciphering latency
? How could we start the deciphering before the instruction is available?✓ Compute some seed from the secret key and the address issued by the CPU✓ Ultra-fast deciphering function that uses the seed (⊕)
If external memory latency ≥ seed computation latency ⇒no performancedegradation even on cache misses
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.48/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Code enciphering: performance
Possible solution: (pseudo) one-time pad ciphers• Synchronous stream cipher• Block ciphers in counter mode, e.g. Ek (X ,@)=DESk (@)⊕X
Warning: one bit flip on Ek (X ,@) flips the same bit on X (integrity!)✓ Confidentiality and integrity are two completely different matters✓ Obfuscation does not help integrity
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.49/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Code enciphering: performance
Possible solution: (pseudo) one-time pad ciphers• Synchronous stream cipher• Block ciphers in counter mode, e.g. Ek (X ,@)=DESk (@)⊕X
Warning: one bit flip on Ek (X ,@) flips the same bit on X (integrity!)✓ Confidentiality and integrity are two completely different matters✓ Obfuscation does not help integrity
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.49/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Code enciphering: performance
Possible solution: (pseudo) one-time pad ciphers• Synchronous stream cipher• Block ciphers in counter mode, e.g. Ek (X ,@)=DESk (@)⊕X
Warning: one bit flip on Ek (X ,@) flips the same bit on X (integrity!)✓ Confidentiality and integrity are two completely different matters✓ Obfuscation does not help integrity
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.49/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Code enciphering: performance
Possible solution: (pseudo) one-time pad ciphers• Synchronous stream cipher• Block ciphers in counter mode, e.g. Ek (X ,@)=DESk (@)⊕X
Warning: one bit flip on Ek (X ,@) flips the same bit on X (integrity!)✓ Confidentiality and integrity are two completely different matters✓ Obfuscation does not help integrity
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.49/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Code enciphering: performance
Possible solution: (pseudo) one-time pad ciphers• Synchronous stream cipher• Block ciphers in counter mode, e.g. Ek (X ,@)=DESk (@)⊕X
Warning: one bit flip on Ek (X ,@) flips the same bit on X (integrity!)✓ Confidentiality and integrity are two completely different matters✓ Obfuscation does not help integrity
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.49/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Code enciphering: performance
Possible solution: (pseudo) one-time pad ciphers• Synchronous stream cipher• Block ciphers in counter mode, e.g. Ek (X ,@)=DESk (@)⊕X
Warning: one bit flip on Ek (X ,@) flips the same bit on X (integrity!)✓ Confidentiality and integrity are two completely different matters✓ Obfuscation does not help integrity
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.49/88 Institut Mines-Telecom R. Pacalet April 21, 2020
On-board probing attacks / Code and data enciphering
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.50/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Code and data enciphering
and decipher themSome non-sensitive data or code can be left unprotectedSecurity improvement: the cipher functions depend on the address
• Instructions and data cannot be seamlessly permutated• ... but data can be «replayed»...
Inte
rcon
nect
Memorycontroller
Externalmemory
CP
U#N
MMU
CP
U#1
MMU
$I
$D
$I
$D
Off-line enciphering
Key EKey
Code
Code
Code
D
On-the-fly code deciphering
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.51/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Code and data enciphering
Bodyguard must also encipher data... and decipher themSome non-sensitive data or code can be left unprotectedSecurity improvement: the cipher functions depend on the address
• Instructions and data cannot be seamlessly permutated• ... but data can be «replayed»...
Inte
rcon
nect
Memorycontroller
Externalmemory
CP
U#N
MMU
CP
U#1
MMU
$I
$D
$I
$D
Off-line enciphering
Key EKey
Code
Code
Code
D
On-the-fly code deciphering
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.51/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Code and data enciphering
Bodyguard must also encipher data... and decipher themSome non-sensitive data or code can be left unprotectedSecurity improvement: the cipher functions depend on the address
• Instructions and data cannot be seamlessly permutated• ... but data can be «replayed»...
Inte
rcon
nect
Memorycontroller
Externalmemory
CP
U#N
MMU
CP
U#1
MMU
$I
$D
$I
$D
Off-line enciphering
Key E
Code
DataKey
Code
CodeE
On-the-fly data enciphering
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.51/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Code and data enciphering
Bodyguard must also encipher data... and decipher themSome non-sensitive data or code can be left unprotectedSecurity improvement: the cipher functions depend on the address
• Instructions and data cannot be seamlessly permutated• ... but data can be «replayed»...
Inte
rcon
nect
Memorycontroller
Externalmemory
CP
U#N
MMU
CP
U#1
MMU
$I
$D
$I
$D
Off-line enciphering
Key E
Code
DataKey
Code
CodeE
On-the-fly data enciphering
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.51/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Code and data enciphering
Bodyguard must also encipher data... and decipher themSome non-sensitive data or code can be left unprotectedSecurity improvement: the cipher functions depend on the address
• Instructions and data cannot be seamlessly permutated• ... but data can be «replayed»...
Inte
rcon
nect
Memorycontroller
Externalmemory
CP
U#N
MMU
CP
U#1
MMU
$I
$D
$I
$D
Off-line enciphering
Key E
Code
DataKey
Code
CodeD
On-the-fly data deciphering
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.51/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Code and data enciphering
Bodyguard must also encipher data... and decipher themSome non-sensitive data or code can be left unprotectedSecurity improvement: the cipher functions depend on the address
• Instructions and data cannot be seamlessly permutated• ... but data can be «replayed»...
Inte
rcon
nect
Memorycontroller
Externalmemory
CP
U#N
MMU
CP
U#1
MMU
$I
$D
$I
$D
Off-line enciphering
Key E
Code
DataKey
Code
CodeD
On-the-fly data deciphering
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.51/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Code and data enciphering
Bodyguard must also encipher data... and decipher themSome non-sensitive data or code can be left unprotectedSecurity improvement: the cipher functions depend on the address
• Instructions and data cannot be seamlessly permutated• ... but data can be «replayed»...
Inte
rcon
nect
Memorycontroller
Externalmemory
CP
U#N
MMU
CP
U#1
MMU
$I
$D
$I
$D
Off-line enciphering
Key E
Code
Code
Codeor
Data
Data
Code
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.51/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Code and data enciphering
Bodyguard must also encipher data... and decipher themSome non-sensitive data or code can be left unprotectedSecurity improvement: the cipher functions depend on the address
• Instructions and data cannot be seamlessly permutated• ... but data can be «replayed»...
Inte
rcon
nect
Memorycontroller
Externalmemory
CP
U#N
MMU
CP
U#1
MMU
$I
$D
$I
$D
Off-line enciphering
Key E
Code
Code
Codeor
Data
Data
Code
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.51/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Code and data enciphering
Bodyguard must also encipher data... and decipher themSome non-sensitive data or code can be left unprotectedSecurity improvement: the cipher functions depend on the address
• Instructions and data cannot be seamlessly permutated• ... but data can be «replayed»...
Inte
rcon
nect
Memorycontroller
Externalmemory
CP
U#N
MMU
CP
U#1
MMU
$I
$D
$I
$D
Off-line enciphering
Key E(@)
Codeper address @
Unique ciphering function
DataKey
Code
CodeD/E(@)
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.51/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Code and data enciphering
Bodyguard must also encipher data... and decipher themSome non-sensitive data or code can be left unprotectedSecurity improvement: the cipher functions depend on the address
• Instructions and data cannot be seamlessly permutated• ... but data can be «replayed»...
Inte
rcon
nect
Memorycontroller
Externalmemory
CP
U#N
MMU
CP
U#1
MMU
$I
$D
$I
$D
Off-line enciphering
Key E(@)
Codeper address @
Unique ciphering function
DataKey
Code
CodeD/E(@)
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.51/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Code and data enciphering
Bodyguard must also encipher data... and decipher themSome non-sensitive data or code can be left unprotectedSecurity improvement: the cipher functions depend on the address
• Instructions and data cannot be seamlessly permutated• ... but data can be «replayed»...
Inte
rcon
nect
Memorycontroller
Externalmemory
CP
U#N
MMU
CP
U#1
MMU
$I
$D
$I
$D
Off-line enciphering
Key E(@)
Codeper address @
Unique ciphering function
DataKey
Code
CodeD/E(@)
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.51/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Code and data enciphering
Same frequently claimed security goals:• Protect embedded software Industrial Property (IP): an attacker probing the bus between
a CPU and its external memory cannot recover IP• Plus: an attacker cannot get information from the data observation• Global system obfuscation: an attacker, whatever her goals are, cannot understand the
system• Integrity: an attacker cannot induce her own code to gain privileged access to the system• Plus: an attacker cannot induce her own data to gain privileged access to the system
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.52/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Code and data enciphering
Same frequently claimed security goals:• Protect embedded software Industrial Property (IP): an attacker probing the bus between
a CPU and its external memory cannot recover IP• Plus: an attacker cannot get information from the data observation• Global system obfuscation: an attacker, whatever her goals are, cannot understand the
system• Integrity: an attacker cannot induce her own code to gain privileged access to the system• Plus: an attacker cannot induce her own data to gain privileged access to the system
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.52/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Code and data enciphering
Same frequently claimed security goals:• Protect embedded software Industrial Property (IP): an attacker probing the bus between
a CPU and its external memory cannot recover IP• Plus: an attacker cannot get information from the data observation• Global system obfuscation: an attacker, whatever her goals are, cannot understand the
system• Integrity: an attacker cannot induce her own code to gain privileged access to the system• Plus: an attacker cannot induce her own data to gain privileged access to the system
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.52/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Code and data enciphering
Same frequently claimed security goals:• Protect embedded software Industrial Property (IP): an attacker probing the bus between
a CPU and its external memory cannot recover IP• Plus: an attacker cannot get information from the data observation• Global system obfuscation: an attacker, whatever her goals are, cannot understand the
system• Integrity: an attacker cannot induce her own code to gain privileged access to the system• Plus: an attacker cannot induce her own data to gain privileged access to the system
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.52/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Code and data enciphering
Same frequently claimed security goals:• Protect embedded software Industrial Property (IP): an attacker probing the bus between
a CPU and its external memory cannot recover IP• Plus: an attacker cannot get information from the data observation• Global system obfuscation: an attacker, whatever her goals are, cannot understand the
system• Integrity: an attacker cannot induce her own code to gain privileged access to the system• Plus: an attacker cannot induce her own data to gain privileged access to the system
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.52/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Code and data enciphering
Same frequently claimed security goals:• Protect embedded software Industrial Property (IP): an attacker probing the bus between
a CPU and its external memory cannot recover IP• Plus: an attacker cannot get information from the data observation• Global system obfuscation: an attacker, whatever her goals are, cannot understand the
system• Integrity: an attacker cannot induce her own code to gain privileged access to the system• Plus: an attacker cannot induce her own data to gain privileged access to the system
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.52/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Markus Kuhn against DS5002FP
DS5002FP• 8 bits «secured» microcontroller• Enciphered external memory (8 bits data and 17 bits addresses)• One 64 bits key, cipher depends on memory address• Dummy accesses when memory bus unused• Instruction fetches randomly swapped with preceding dummy access• No integrity check• 10 years life lithium battery (for on-chip key memory and off-chip SRAM)
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.53/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Markus Kuhn against DS5002FP
DS5002FP• 8 bits «secured» microcontroller• Enciphered external memory (8 bits data and 17 bits addresses)• One 64 bits key, cipher depends on memory address• Dummy accesses when memory bus unused• Instruction fetches randomly swapped with preceding dummy access• No integrity check• 10 years life lithium battery (for on-chip key memory and off-chip SRAM)
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.53/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Markus Kuhn against DS5002FP
DS5002FP• 8 bits «secured» microcontroller• Enciphered external memory (8 bits data and 17 bits addresses)• One 64 bits key, cipher depends on memory address• Dummy accesses when memory bus unused• Instruction fetches randomly swapped with preceding dummy access• No integrity check• 10 years life lithium battery (for on-chip key memory and off-chip SRAM)
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.53/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Markus Kuhn against DS5002FP
DS5002FP• 8 bits «secured» microcontroller• Enciphered external memory (8 bits data and 17 bits addresses)• One 64 bits key, cipher depends on memory address• Dummy accesses when memory bus unused• Instruction fetches randomly swapped with preceding dummy access• No integrity check• 10 years life lithium battery (for on-chip key memory and off-chip SRAM)
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.53/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Markus Kuhn against DS5002FP
DS5002FP• 8 bits «secured» microcontroller• Enciphered external memory (8 bits data and 17 bits addresses)• One 64 bits key, cipher depends on memory address• Dummy accesses when memory bus unused• Instruction fetches randomly swapped with preceding dummy access• No integrity check• 10 years life lithium battery (for on-chip key memory and off-chip SRAM)
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.53/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Markus Kuhn against DS5002FP
DS5002FP• 8 bits «secured» microcontroller• Enciphered external memory (8 bits data and 17 bits addresses)• One 64 bits key, cipher depends on memory address• Dummy accesses when memory bus unused• Instruction fetches randomly swapped with preceding dummy access• No integrity check• 10 years life lithium battery (for on-chip key memory and off-chip SRAM)
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.53/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Markus Kuhn against DS5002FP
DS5002FP• 8 bits «secured» microcontroller• Enciphered external memory (8 bits data and 17 bits addresses)• One 64 bits key, cipher depends on memory address• Dummy accesses when memory bus unused• Instruction fetches randomly swapped with preceding dummy access• No integrity check• 10 years life lithium battery (for on-chip key memory and off-chip SRAM)
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.53/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Markus Kuhn against DS5002FP
DS5002FP• 8 bits «secured» microcontroller• Enciphered external memory (8 bits data and 17 bits addresses)• One 64 bits key, cipher depends on memory address• Dummy accesses when memory bus unused• Instruction fetches randomly swapped with preceding dummy access• No integrity check• 10 years life lithium battery (for on-chip key memory and off-chip SRAM)
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.53/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Markus Kuhn against DS5002FP
Markus Kuhn• Brilliant mind, curious and motivated, master student
Memory bus passive and active probingInjections with switch between SRAM and custom FIFODictionary attack: even if key unknown, 8 bits block ciphers are just 256 ↔ 256bijectionsFirst step: exhaustive search of first three bytes (X ,Y ,Z ) such thatDk (X ,Y ,Z )≡ MOV PP1 T (write T to parallel port #1)
• This will completely disclose E0(T )=Z , the enciphering function at address of Z (try all Z(256) and recover dictionary)
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.54/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Markus Kuhn against DS5002FP
Markus Kuhn• Brilliant mind, curious and motivated, master student
Memory bus passive and active probingInjections with switch between SRAM and custom FIFODictionary attack: even if key unknown, 8 bits block ciphers are just 256 ↔ 256bijectionsFirst step: exhaustive search of first three bytes (X ,Y ,Z ) such thatDk (X ,Y ,Z )≡ MOV PP1 T (write T to parallel port #1)
• This will completely disclose E0(T )=Z , the enciphering function at address of Z (try all Z(256) and recover dictionary)
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.54/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Markus Kuhn against DS5002FP
Markus Kuhn• Brilliant mind, curious and motivated, master student
Memory bus passive and active probingInjections with switch between SRAM and custom FIFODictionary attack: even if key unknown, 8 bits block ciphers are just 256 ↔ 256bijectionsFirst step: exhaustive search of first three bytes (X ,Y ,Z ) such thatDk (X ,Y ,Z )≡ MOV PP1 T (write T to parallel port #1)
• This will completely disclose E0(T )=Z , the enciphering function at address of Z (try all Z(256) and recover dictionary)
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.54/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Markus Kuhn against DS5002FP
Markus Kuhn• Brilliant mind, curious and motivated, master student
Memory bus passive and active probingInjections with switch between SRAM and custom FIFODictionary attack: even if key unknown, 8 bits block ciphers are just 256 ↔ 256bijectionsFirst step: exhaustive search of first three bytes (X ,Y ,Z ) such thatDk (X ,Y ,Z )≡ MOV PP1 T (write T to parallel port #1)
• This will completely disclose E0(T )=Z , the enciphering function at address of Z (try all Z(256) and recover dictionary)
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.54/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Markus Kuhn against DS5002FP
Markus Kuhn• Brilliant mind, curious and motivated, master student
Memory bus passive and active probingInjections with switch between SRAM and custom FIFODictionary attack: even if key unknown, 8 bits block ciphers are just 256 ↔ 256bijectionsFirst step: exhaustive search of first three bytes (X ,Y ,Z ) such thatDk (X ,Y ,Z )≡ MOV PP1 T (write T to parallel port #1)
• This will completely disclose E0(T )=Z , the enciphering function at address of Z (try all Z(256) and recover dictionary)
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.54/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Markus Kuhn against DS5002FP
Markus Kuhn• Brilliant mind, curious and motivated, master student
Memory bus passive and active probingInjections with switch between SRAM and custom FIFODictionary attack: even if key unknown, 8 bits block ciphers are just 256 ↔ 256bijectionsFirst step: exhaustive search of first three bytes (X ,Y ,Z ) such thatDk (X ,Y ,Z )≡ MOV PP1 T (write T to parallel port #1)
• This will completely disclose E0(T )=Z , the enciphering function at address of Z (try all Z(256) and recover dictionary)
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.54/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Markus Kuhn against DS5002FP
Markus Kuhn• Brilliant mind, curious and motivated, master student
Memory bus passive and active probingInjections with switch between SRAM and custom FIFODictionary attack: even if key unknown, 8 bits block ciphers are just 256 ↔ 256bijectionsFirst step: exhaustive search of first three bytes (X ,Y ,Z ) such thatDk (X ,Y ,Z )≡ MOV PP1 T (write T to parallel port #1)
• This will completely disclose E0(T )=Z , the enciphering function at address of Z (try all Z(256) and recover dictionary)
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.54/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Markus Kuhn against DS5002FP
Markus tries all (X ,Y ) such that Z ↔T is a bijection• About 217 reset, 300 reset/s ⇒7 minutes• E0 is fully known (but not the key)• Markus can now inject anything at Z ’s address
Next steps:• Search X ≡ NOP• Move ahead until enough Ei are known• Inject a complete «dump out» program
It took a few hours and a US$300 equipment to a master student✓ Dictionary attacks are serious threats✓ Integrity cannot be guaranteed by enciphered busses
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.55/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Markus Kuhn against DS5002FP
Markus tries all (X ,Y ) such that Z ↔T is a bijection• About 217 reset, 300 reset/s ⇒7 minutes• E0 is fully known (but not the key)• Markus can now inject anything at Z ’s address
Next steps:• Search X ≡ NOP• Move ahead until enough Ei are known• Inject a complete «dump out» program
It took a few hours and a US$300 equipment to a master student✓ Dictionary attacks are serious threats✓ Integrity cannot be guaranteed by enciphered busses
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.55/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Markus Kuhn against DS5002FP
Markus tries all (X ,Y ) such that Z ↔T is a bijection• About 217 reset, 300 reset/s ⇒7 minutes• E0 is fully known (but not the key)• Markus can now inject anything at Z ’s address
Next steps:• Search X ≡ NOP• Move ahead until enough Ei are known• Inject a complete «dump out» program
It took a few hours and a US$300 equipment to a master student✓ Dictionary attacks are serious threats✓ Integrity cannot be guaranteed by enciphered busses
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.55/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Markus Kuhn against DS5002FP
Markus tries all (X ,Y ) such that Z ↔T is a bijection• About 217 reset, 300 reset/s ⇒7 minutes• E0 is fully known (but not the key)• Markus can now inject anything at Z ’s address
Next steps:• Search X ≡ NOP• Move ahead until enough Ei are known• Inject a complete «dump out» program
It took a few hours and a US$300 equipment to a master student✓ Dictionary attacks are serious threats✓ Integrity cannot be guaranteed by enciphered busses
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.55/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Markus Kuhn against DS5002FP
Markus tries all (X ,Y ) such that Z ↔T is a bijection• About 217 reset, 300 reset/s ⇒7 minutes• E0 is fully known (but not the key)• Markus can now inject anything at Z ’s address
Next steps:• Search X ≡ NOP• Move ahead until enough Ei are known• Inject a complete «dump out» program
It took a few hours and a US$300 equipment to a master student✓ Dictionary attacks are serious threats✓ Integrity cannot be guaranteed by enciphered busses
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.55/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Markus Kuhn against DS5002FP
Markus tries all (X ,Y ) such that Z ↔T is a bijection• About 217 reset, 300 reset/s ⇒7 minutes• E0 is fully known (but not the key)• Markus can now inject anything at Z ’s address
Next steps:• Search X ≡ NOP• Move ahead until enough Ei are known• Inject a complete «dump out» program
It took a few hours and a US$300 equipment to a master student✓ Dictionary attacks are serious threats✓ Integrity cannot be guaranteed by enciphered busses
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.55/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Markus Kuhn against DS5002FP
Markus tries all (X ,Y ) such that Z ↔T is a bijection• About 217 reset, 300 reset/s ⇒7 minutes• E0 is fully known (but not the key)• Markus can now inject anything at Z ’s address
Next steps:• Search X ≡ NOP• Move ahead until enough Ei are known• Inject a complete «dump out» program
It took a few hours and a US$300 equipment to a master student✓ Dictionary attacks are serious threats✓ Integrity cannot be guaranteed by enciphered busses
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.55/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Markus Kuhn against DS5002FP
Markus tries all (X ,Y ) such that Z ↔T is a bijection• About 217 reset, 300 reset/s ⇒7 minutes• E0 is fully known (but not the key)• Markus can now inject anything at Z ’s address
Next steps:• Search X ≡ NOP• Move ahead until enough Ei are known• Inject a complete «dump out» program
It took a few hours and a US$300 equipment to a master student✓ Dictionary attacks are serious threats✓ Integrity cannot be guaranteed by enciphered busses
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.55/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Markus Kuhn against DS5002FP
Markus tries all (X ,Y ) such that Z ↔T is a bijection• About 217 reset, 300 reset/s ⇒7 minutes• E0 is fully known (but not the key)• Markus can now inject anything at Z ’s address
Next steps:• Search X ≡ NOP• Move ahead until enough Ei are known• Inject a complete «dump out» program
It took a few hours and a US$300 equipment to a master student✓ Dictionary attacks are serious threats✓ Integrity cannot be guaranteed by enciphered busses
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.55/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Markus Kuhn against DS5002FP
Markus tries all (X ,Y ) such that Z ↔T is a bijection• About 217 reset, 300 reset/s ⇒7 minutes• E0 is fully known (but not the key)• Markus can now inject anything at Z ’s address
Next steps:• Search X ≡ NOP• Move ahead until enough Ei are known• Inject a complete «dump out» program
It took a few hours and a US$300 equipment to a master student✓ Dictionary attacks are serious threats✓ Integrity cannot be guaranteed by enciphered busses
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.55/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Markus Kuhn against DS5002FP
Markus tries all (X ,Y ) such that Z ↔T is a bijection• About 217 reset, 300 reset/s ⇒7 minutes• E0 is fully known (but not the key)• Markus can now inject anything at Z ’s address
Next steps:• Search X ≡ NOP• Move ahead until enough Ei are known• Inject a complete «dump out» program
It took a few hours and a US$300 equipment to a master student✓ Dictionary attacks are serious threats✓ Integrity cannot be guaranteed by enciphered busses
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.55/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Code and data enciphering
Actual security properties vs. claimed security goals• Protect embedded software IP: yes
– As long as the secret key is protected– As long as a dictionary attack remains infeasible
• Global system obfuscation: yes– As long as the secret key is protected– As long as a dictionary attack remains infeasible
• Integrity: no– Any data or instruction can be replaced by anything, anytime
Performance• No penalty until cache miss• Cache misses have their cost increased by the deciphering latency• Embedded enciphering-deciphering function ⇒silicon area and power
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.56/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Code and data enciphering
Actual security properties vs. claimed security goals• Protect embedded software IP: yes
– As long as the secret key is protected– As long as a dictionary attack remains infeasible
• Global system obfuscation: yes– As long as the secret key is protected– As long as a dictionary attack remains infeasible
• Integrity: no– Any data or instruction can be replaced by anything, anytime
Performance• No penalty until cache miss• Cache misses have their cost increased by the deciphering latency• Embedded enciphering-deciphering function ⇒silicon area and power
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.56/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Code and data enciphering
Actual security properties vs. claimed security goals• Protect embedded software IP: yes
– As long as the secret key is protected– As long as a dictionary attack remains infeasible
• Global system obfuscation: yes– As long as the secret key is protected– As long as a dictionary attack remains infeasible
• Integrity: no– Any data or instruction can be replaced by anything, anytime
Performance• No penalty until cache miss• Cache misses have their cost increased by the deciphering latency• Embedded enciphering-deciphering function ⇒silicon area and power
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.56/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Code and data enciphering
Actual security properties vs. claimed security goals• Protect embedded software IP: yes
– As long as the secret key is protected– As long as a dictionary attack remains infeasible
• Global system obfuscation: yes– As long as the secret key is protected– As long as a dictionary attack remains infeasible
• Integrity: no– Any data or instruction can be replaced by anything, anytime
Performance• No penalty until cache miss• Cache misses have their cost increased by the deciphering latency• Embedded enciphering-deciphering function ⇒silicon area and power
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.56/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Code and data enciphering
Actual security properties vs. claimed security goals• Protect embedded software IP: yes
– As long as the secret key is protected– As long as a dictionary attack remains infeasible
• Global system obfuscation: yes– As long as the secret key is protected– As long as a dictionary attack remains infeasible
• Integrity: no– Any data or instruction can be replaced by anything, anytime
Performance• No penalty until cache miss• Cache misses have their cost increased by the deciphering latency• Embedded enciphering-deciphering function ⇒silicon area and power
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.56/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Code and data enciphering
Actual security properties vs. claimed security goals• Protect embedded software IP: yes
– As long as the secret key is protected– As long as a dictionary attack remains infeasible
• Global system obfuscation: yes– As long as the secret key is protected– As long as a dictionary attack remains infeasible
• Integrity: no– Any data or instruction can be replaced by anything, anytime
Performance• No penalty until cache miss• Cache misses have their cost increased by the deciphering latency• Embedded enciphering-deciphering function ⇒silicon area and power
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.56/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Code and data enciphering
Actual security properties vs. claimed security goals• Protect embedded software IP: yes
– As long as the secret key is protected– As long as a dictionary attack remains infeasible
• Global system obfuscation: yes– As long as the secret key is protected– As long as a dictionary attack remains infeasible
• Integrity: no– Any data or instruction can be replaced by anything, anytime
Performance• No penalty until cache miss• Cache misses have their cost increased by the deciphering latency• Embedded enciphering-deciphering function ⇒silicon area and power
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.56/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Code and data enciphering
Actual security properties vs. claimed security goals• Protect embedded software IP: yes
– As long as the secret key is protected– As long as a dictionary attack remains infeasible
• Global system obfuscation: yes– As long as the secret key is protected– As long as a dictionary attack remains infeasible
• Integrity: no– Any data or instruction can be replaced by anything, anytime
Performance• No penalty until cache miss• Cache misses have their cost increased by the deciphering latency• Embedded enciphering-deciphering function ⇒silicon area and power
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.56/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Code and data enciphering
Actual security properties vs. claimed security goals• Protect embedded software IP: yes
– As long as the secret key is protected– As long as a dictionary attack remains infeasible
• Global system obfuscation: yes– As long as the secret key is protected– As long as a dictionary attack remains infeasible
• Integrity: no– Any data or instruction can be replaced by anything, anytime
Performance• No penalty until cache miss• Cache misses have their cost increased by the deciphering latency• Embedded enciphering-deciphering function ⇒silicon area and power
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.56/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Code and data enciphering
Actual security properties vs. claimed security goals• Protect embedded software IP: yes
– As long as the secret key is protected– As long as a dictionary attack remains infeasible
• Global system obfuscation: yes– As long as the secret key is protected– As long as a dictionary attack remains infeasible
• Integrity: no– Any data or instruction can be replaced by anything, anytime
Performance• No penalty until cache miss• Cache misses have their cost increased by the deciphering latency• Embedded enciphering-deciphering function ⇒silicon area and power
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.56/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Code and data enciphering
Actual security properties vs. claimed security goals• Protect embedded software IP: yes
– As long as the secret key is protected– As long as a dictionary attack remains infeasible
• Global system obfuscation: yes– As long as the secret key is protected– As long as a dictionary attack remains infeasible
• Integrity: no– Any data or instruction can be replaced by anything, anytime
Performance• No penalty until cache miss• Cache misses have their cost increased by the deciphering latency• Embedded enciphering-deciphering function ⇒silicon area and power
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.56/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Code and data enciphering
Actual security properties vs. claimed security goals• Protect embedded software IP: yes
– As long as the secret key is protected– As long as a dictionary attack remains infeasible
• Global system obfuscation: yes– As long as the secret key is protected– As long as a dictionary attack remains infeasible
• Integrity: no– Any data or instruction can be replaced by anything, anytime
Performance• No penalty until cache miss• Cache misses have their cost increased by the deciphering latency• Embedded enciphering-deciphering function ⇒silicon area and power
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.56/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Code and data enciphering
Actual security properties vs. claimed security goals• Protect embedded software IP: yes
– As long as the secret key is protected– As long as a dictionary attack remains infeasible
• Global system obfuscation: yes– As long as the secret key is protected– As long as a dictionary attack remains infeasible
• Integrity: no– Any data or instruction can be replaced by anything, anytime
Performance• No penalty until cache miss• Cache misses have their cost increased by the deciphering latency• Embedded enciphering-deciphering function ⇒silicon area and power
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.56/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Performance enhancements
The same enhancement (one-time pad) holds for code and Read-Only (RO) dataBut not for Read-Write (RW) data!
? Why?✓ On read-write locations «one-time» pad is many-times!✓ Ek (X ,@)⊕Ek (Y ,@)=DESk (@)⊕X ⊕DESk (@)⊕Y =X ⊕Y
RW-data confidentiality cannot be protected by one-time padRegular symmetric block ciphers are neededRW-(en)deciphering latency cannot overlap memory latencyPerformance degradation on data cache missesCan be huge...... or not: hundreds of clock cycles memory latencies are common
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.57/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Performance enhancements
The same enhancement (one-time pad) holds for code and Read-Only (RO) dataBut not for Read-Write (RW) data!
? Why?✓ On read-write locations «one-time» pad is many-times!✓ Ek (X ,@)⊕Ek (Y ,@)=DESk (@)⊕X ⊕DESk (@)⊕Y =X ⊕Y
RW-data confidentiality cannot be protected by one-time padRegular symmetric block ciphers are neededRW-(en)deciphering latency cannot overlap memory latencyPerformance degradation on data cache missesCan be huge...... or not: hundreds of clock cycles memory latencies are common
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.57/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Performance enhancements
The same enhancement (one-time pad) holds for code and Read-Only (RO) dataBut not for Read-Write (RW) data!
? Why?✓ On read-write locations «one-time» pad is many-times!✓ Ek (X ,@)⊕Ek (Y ,@)=DESk (@)⊕X ⊕DESk (@)⊕Y =X ⊕Y
RW-data confidentiality cannot be protected by one-time padRegular symmetric block ciphers are neededRW-(en)deciphering latency cannot overlap memory latencyPerformance degradation on data cache missesCan be huge...... or not: hundreds of clock cycles memory latencies are common
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.57/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Performance enhancements
The same enhancement (one-time pad) holds for code and Read-Only (RO) dataBut not for Read-Write (RW) data!
? Why?✓ On read-write locations «one-time» pad is many-times!✓ Ek (X ,@)⊕Ek (Y ,@)=DESk (@)⊕X ⊕DESk (@)⊕Y =X ⊕Y
RW-data confidentiality cannot be protected by one-time padRegular symmetric block ciphers are neededRW-(en)deciphering latency cannot overlap memory latencyPerformance degradation on data cache missesCan be huge...... or not: hundreds of clock cycles memory latencies are common
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.57/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Performance enhancements
The same enhancement (one-time pad) holds for code and Read-Only (RO) dataBut not for Read-Write (RW) data!
? Why?✓ On read-write locations «one-time» pad is many-times!✓ Ek (X ,@)⊕Ek (Y ,@)=DESk (@)⊕X ⊕DESk (@)⊕Y =X ⊕Y
RW-data confidentiality cannot be protected by one-time padRegular symmetric block ciphers are neededRW-(en)deciphering latency cannot overlap memory latencyPerformance degradation on data cache missesCan be huge...... or not: hundreds of clock cycles memory latencies are common
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.57/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Performance enhancements
The same enhancement (one-time pad) holds for code and Read-Only (RO) dataBut not for Read-Write (RW) data!
? Why?✓ On read-write locations «one-time» pad is many-times!✓ Ek (X ,@)⊕Ek (Y ,@)=DESk (@)⊕X ⊕DESk (@)⊕Y =X ⊕Y
RW-data confidentiality cannot be protected by one-time padRegular symmetric block ciphers are neededRW-(en)deciphering latency cannot overlap memory latencyPerformance degradation on data cache missesCan be huge...... or not: hundreds of clock cycles memory latencies are common
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.57/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Performance enhancements
The same enhancement (one-time pad) holds for code and Read-Only (RO) dataBut not for Read-Write (RW) data!
? Why?✓ On read-write locations «one-time» pad is many-times!✓ Ek (X ,@)⊕Ek (Y ,@)=DESk (@)⊕X ⊕DESk (@)⊕Y =X ⊕Y
RW-data confidentiality cannot be protected by one-time padRegular symmetric block ciphers are neededRW-(en)deciphering latency cannot overlap memory latencyPerformance degradation on data cache missesCan be huge...... or not: hundreds of clock cycles memory latencies are common
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.57/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Performance enhancements
The same enhancement (one-time pad) holds for code and Read-Only (RO) dataBut not for Read-Write (RW) data!
? Why?✓ On read-write locations «one-time» pad is many-times!✓ Ek (X ,@)⊕Ek (Y ,@)=DESk (@)⊕X ⊕DESk (@)⊕Y =X ⊕Y
RW-data confidentiality cannot be protected by one-time padRegular symmetric block ciphers are neededRW-(en)deciphering latency cannot overlap memory latencyPerformance degradation on data cache missesCan be huge...... or not: hundreds of clock cycles memory latencies are common
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.57/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Performance enhancements
The same enhancement (one-time pad) holds for code and Read-Only (RO) dataBut not for Read-Write (RW) data!
? Why?✓ On read-write locations «one-time» pad is many-times!✓ Ek (X ,@)⊕Ek (Y ,@)=DESk (@)⊕X ⊕DESk (@)⊕Y =X ⊕Y
RW-data confidentiality cannot be protected by one-time padRegular symmetric block ciphers are neededRW-(en)deciphering latency cannot overlap memory latencyPerformance degradation on data cache missesCan be huge...... or not: hundreds of clock cycles memory latencies are common
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.57/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Performance enhancements
The same enhancement (one-time pad) holds for code and Read-Only (RO) dataBut not for Read-Write (RW) data!
? Why?✓ On read-write locations «one-time» pad is many-times!✓ Ek (X ,@)⊕Ek (Y ,@)=DESk (@)⊕X ⊕DESk (@)⊕Y =X ⊕Y
RW-data confidentiality cannot be protected by one-time padRegular symmetric block ciphers are neededRW-(en)deciphering latency cannot overlap memory latencyPerformance degradation on data cache missesCan be huge...... or not: hundreds of clock cycles memory latencies are common
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.57/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Performance enhancements
The same enhancement (one-time pad) holds for code and Read-Only (RO) dataBut not for Read-Write (RW) data!
? Why?✓ On read-write locations «one-time» pad is many-times!✓ Ek (X ,@)⊕Ek (Y ,@)=DESk (@)⊕X ⊕DESk (@)⊕Y =X ⊕Y
RW-data confidentiality cannot be protected by one-time padRegular symmetric block ciphers are neededRW-(en)deciphering latency cannot overlap memory latencyPerformance degradation on data cache missesCan be huge...... or not: hundreds of clock cycles memory latencies are common
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.57/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Some possible security enhancements
Secret key cannot be accessed by softwareMultiple keys, maybe enciphered by a master key (public key cryptography?)Every CPU has a unique master keyA more general master key per chip manufacturer could be neededDifferent keys for code and dataData keys change randomly at resetIllegal instructions trapped and used as intrusion detection
• Beware the bogus software
Anyway, integrity would really be a must!
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.58/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Some possible security enhancements
Secret key cannot be accessed by softwareMultiple keys, maybe enciphered by a master key (public key cryptography?)Every CPU has a unique master keyA more general master key per chip manufacturer could be neededDifferent keys for code and dataData keys change randomly at resetIllegal instructions trapped and used as intrusion detection
• Beware the bogus software
Anyway, integrity would really be a must!
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.58/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Some possible security enhancements
Secret key cannot be accessed by softwareMultiple keys, maybe enciphered by a master key (public key cryptography?)Every CPU has a unique master keyA more general master key per chip manufacturer could be neededDifferent keys for code and dataData keys change randomly at resetIllegal instructions trapped and used as intrusion detection
• Beware the bogus software
Anyway, integrity would really be a must!
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.58/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Some possible security enhancements
Secret key cannot be accessed by softwareMultiple keys, maybe enciphered by a master key (public key cryptography?)Every CPU has a unique master keyA more general master key per chip manufacturer could be neededDifferent keys for code and dataData keys change randomly at resetIllegal instructions trapped and used as intrusion detection
• Beware the bogus software
Anyway, integrity would really be a must!
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.58/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Some possible security enhancements
Secret key cannot be accessed by softwareMultiple keys, maybe enciphered by a master key (public key cryptography?)Every CPU has a unique master keyA more general master key per chip manufacturer could be neededDifferent keys for code and dataData keys change randomly at resetIllegal instructions trapped and used as intrusion detection
• Beware the bogus software
Anyway, integrity would really be a must!
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.58/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Some possible security enhancements
Secret key cannot be accessed by softwareMultiple keys, maybe enciphered by a master key (public key cryptography?)Every CPU has a unique master keyA more general master key per chip manufacturer could be neededDifferent keys for code and dataData keys change randomly at resetIllegal instructions trapped and used as intrusion detection
• Beware the bogus software
Anyway, integrity would really be a must!
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.58/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Some possible security enhancements
Secret key cannot be accessed by softwareMultiple keys, maybe enciphered by a master key (public key cryptography?)Every CPU has a unique master keyA more general master key per chip manufacturer could be neededDifferent keys for code and dataData keys change randomly at resetIllegal instructions trapped and used as intrusion detection
• Beware the bogus software
Anyway, integrity would really be a must!
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.58/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Some possible security enhancements
Secret key cannot be accessed by softwareMultiple keys, maybe enciphered by a master key (public key cryptography?)Every CPU has a unique master keyA more general master key per chip manufacturer could be neededDifferent keys for code and dataData keys change randomly at resetIllegal instructions trapped and used as intrusion detection
• Beware the bogus software
Anyway, integrity would really be a must!
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.58/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Some possible security enhancements
Secret key cannot be accessed by softwareMultiple keys, maybe enciphered by a master key (public key cryptography?)Every CPU has a unique master keyA more general master key per chip manufacturer could be neededDifferent keys for code and dataData keys change randomly at resetIllegal instructions trapped and used as intrusion detection
• Beware the bogus software
Anyway, integrity would really be a must!
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.58/88 Institut Mines-Telecom R. Pacalet April 21, 2020
On-board probing attacks / Integrity
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.59/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Attacks against integrity
@+1@
T
T+1
Space
Time
D
CA
B E
Spoofing attack:
space permutation
Replay attack:temporal permutation
Splicing attack:
injection of forged data
Source: Ronan Keryell
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.60/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Attacks against integrity
@+1@
T
T+1
Space
Time
D
CA
B E
Spoofing attack:
space permutation
Replay attack:temporal permutation
Splicing attack:
injection of forged data
Source: Ronan Keryell
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.60/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Why check memory integrity?
Because strong enciphering of data or instructions does not protect against spoofing,splicing or replay...An attacker could:
• Inject forged data• Permutate two memory locations• Replay an old data at same address
– Prevent a memory write and induce an infinite loop:for(i = 0; i < size; i++)
print(*p++);
A lot of integrity attacks are possible and dangerousThey aim at modifying the behaviour of the system (fault attacks)The system needs a way to detect any malevolent modification
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.61/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Why check memory integrity?
Because strong enciphering of data or instructions does not protect against spoofing,splicing or replay...An attacker could:
• Inject forged data• Permutate two memory locations• Replay an old data at same address
– Prevent a memory write and induce an infinite loop:for(i = 0; i < size; i++)
print(*p++);
A lot of integrity attacks are possible and dangerousThey aim at modifying the behaviour of the system (fault attacks)The system needs a way to detect any malevolent modification
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.61/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Why check memory integrity?
Because strong enciphering of data or instructions does not protect against spoofing,splicing or replay...An attacker could:
• Inject forged data• Permutate two memory locations• Replay an old data at same address
– Prevent a memory write and induce an infinite loop:for(i = 0; i < size; i++)
print(*p++);
A lot of integrity attacks are possible and dangerousThey aim at modifying the behaviour of the system (fault attacks)The system needs a way to detect any malevolent modification
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.61/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Why check memory integrity?
Because strong enciphering of data or instructions does not protect against spoofing,splicing or replay...An attacker could:
• Inject forged data• Permutate two memory locations• Replay an old data at same address
– Prevent a memory write and induce an infinite loop:for(i = 0; i < size; i++)
print(*p++);
A lot of integrity attacks are possible and dangerousThey aim at modifying the behaviour of the system (fault attacks)The system needs a way to detect any malevolent modification
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.61/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Why check memory integrity?
Because strong enciphering of data or instructions does not protect against spoofing,splicing or replay...An attacker could:
• Inject forged data• Permutate two memory locations• Replay an old data at same address
– Prevent a memory write and induce an infinite loop:for(i = 0; i < size; i++)
print(*p++);
A lot of integrity attacks are possible and dangerousThey aim at modifying the behaviour of the system (fault attacks)The system needs a way to detect any malevolent modification
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.61/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Why check memory integrity?
Because strong enciphering of data or instructions does not protect against spoofing,splicing or replay...An attacker could:
• Inject forged data• Permutate two memory locations• Replay an old data at same address
– Prevent a memory write and induce an infinite loop:for(i = 0; i < size; i++)
print(*p++);
A lot of integrity attacks are possible and dangerousThey aim at modifying the behaviour of the system (fault attacks)The system needs a way to detect any malevolent modification
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.61/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Why check memory integrity?
Because strong enciphering of data or instructions does not protect against spoofing,splicing or replay...An attacker could:
• Inject forged data• Permutate two memory locations• Replay an old data at same address
– Prevent a memory write and induce an infinite loop:for(i = 0; i < size; i++)
print(*p++);
A lot of integrity attacks are possible and dangerousThey aim at modifying the behaviour of the system (fault attacks)The system needs a way to detect any malevolent modification
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.61/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Why check memory integrity?
Because strong enciphering of data or instructions does not protect against spoofing,splicing or replay...An attacker could:
• Inject forged data• Permutate two memory locations• Replay an old data at same address
– Prevent a memory write and induce an infinite loop:for(i = 0; i < size; i++)
print(*p++);
A lot of integrity attacks are possible and dangerousThey aim at modifying the behaviour of the system (fault attacks)The system needs a way to detect any malevolent modification
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.61/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Why check memory integrity?
Because strong enciphering of data or instructions does not protect against spoofing,splicing or replay...An attacker could:
• Inject forged data• Permutate two memory locations• Replay an old data at same address
– Prevent a memory write and induce an infinite loop:for(i = 0; i < size; i++)
print(*p++);
A lot of integrity attacks are possible and dangerousThey aim at modifying the behaviour of the system (fault attacks)The system needs a way to detect any malevolent modification
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.61/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Cryptographic hash functions
Cryptographic hash functions are designed to check integrityHash function H produces constant length digest h =H(M) from variable lengthmessage MImpossible to forge message with given digest (pre-image)Impossible to find two message with same digest (collision)Hash functions are also named one-way functionsMD5, SHA-0, SHA-1, SHA-2, SHA-3
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.62/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Cryptographic hash functions
Cryptographic hash functions are designed to check integrityHash function H produces constant length digest h =H(M) from variable lengthmessage MImpossible to forge message with given digest (pre-image)Impossible to find two message with same digest (collision)Hash functions are also named one-way functionsMD5, SHA-0, SHA-1, SHA-2, SHA-3
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.62/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Cryptographic hash functions
Cryptographic hash functions are designed to check integrityHash function H produces constant length digest h =H(M) from variable lengthmessage MImpossible to forge message with given digest (pre-image)Impossible to find two message with same digest (collision)Hash functions are also named one-way functionsMD5, SHA-0, SHA-1, SHA-2, SHA-3
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.62/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Cryptographic hash functions
Cryptographic hash functions are designed to check integrityHash function H produces constant length digest h =H(M) from variable lengthmessage MImpossible to forge message with given digest (pre-image)Impossible to find two message with same digest (collision)Hash functions are also named one-way functionsMD5, SHA-0, SHA-1, SHA-2, SHA-3
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.62/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Cryptographic hash functions
Cryptographic hash functions are designed to check integrityHash function H produces constant length digest h =H(M) from variable lengthmessage MImpossible to forge message with given digest (pre-image)Impossible to find two message with same digest (collision)Hash functions are also named one-way functionsMD5, SHA-0, SHA-1, SHA-2, SHA-3
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.62/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Cryptographic hash functions
Cryptographic hash functions are designed to check integrityHash function H produces constant length digest h =H(M) from variable lengthmessage MImpossible to forge message with given digest (pre-image)Impossible to find two message with same digest (collision)Hash functions are also named one-way functionsMD5, SHA-0, SHA-1, SHA-2, SHA-3
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.62/88 Institut Mines-Telecom R. Pacalet April 21, 2020
How to check memory integrity?
✓ Group data in constant lenght chunks✓ Store chunks’ digests somewhere in memory✓ Upon read access
✓ Read whole chunk C✓ Compute chunk’s digest h =H(C)✓ Read digest h from memory✓ Compare digests
✓ h = h ⇒ OK✓ h = h ⇒ not OK
? What about write accesses?
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.63/88 Institut Mines-Telecom R. Pacalet April 21, 2020
How to check memory integrity?
✓ Group data in constant lenght chunks✓ Store chunks’ digests somewhere in memory✓ Upon read access
✓ Read whole chunk C✓ Compute chunk’s digest h =H(C)✓ Read digest h from memory✓ Compare digests
✓ h = h ⇒ OK✓ h = h ⇒ not OK
? What about write accesses?
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.63/88 Institut Mines-Telecom R. Pacalet April 21, 2020
How to check memory integrity?
✓ Group data in constant lenght chunks✓ Store chunks’ digests somewhere in memory✓ Upon read access
✓ Read whole chunk C✓ Compute chunk’s digest h =H(C)✓ Read digest h from memory✓ Compare digests
✓ h = h ⇒ OK✓ h = h ⇒ not OK
? What about write accesses?
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.63/88 Institut Mines-Telecom R. Pacalet April 21, 2020
How to check memory integrity?
✓ Group data in constant lenght chunks✓ Store chunks’ digests somewhere in memory✓ Upon read access
✓ Read whole chunk C✓ Compute chunk’s digest h =H(C)✓ Read digest h from memory✓ Compare digests
✓ h = h ⇒ OK✓ h = h ⇒ not OK
? What about write accesses?
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.63/88 Institut Mines-Telecom R. Pacalet April 21, 2020
How to check memory integrity?
✓ Group data in constant lenght chunks✓ Store chunks’ digests somewhere in memory✓ Upon read access
✓ Read whole chunk C✓ Compute chunk’s digest h =H(C)✓ Read digest h from memory✓ Compare digests
✓ h = h ⇒ OK✓ h = h ⇒ not OK
? What about write accesses?
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.63/88 Institut Mines-Telecom R. Pacalet April 21, 2020
How to check memory integrity?
✓ Group data in constant lenght chunks✓ Store chunks’ digests somewhere in memory✓ Upon read access
✓ Read whole chunk C✓ Compute chunk’s digest h =H(C)✓ Read digest h from memory✓ Compare digests
✓ h = h ⇒ OK✓ h = h ⇒ not OK
? What about write accesses?
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.63/88 Institut Mines-Telecom R. Pacalet April 21, 2020
How to check memory integrity?
✓ Group data in constant lenght chunks✓ Store chunks’ digests somewhere in memory✓ Upon read access
✓ Read whole chunk C✓ Compute chunk’s digest h =H(C)✓ Read digest h from memory✓ Compare digests
✓ h = h ⇒ OK✓ h = h ⇒ not OK
? What about write accesses?
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.63/88 Institut Mines-Telecom R. Pacalet April 21, 2020
How to check memory integrity?
✓ Group data in constant lenght chunks✓ Store chunks’ digests somewhere in memory✓ Upon read access
✓ Read whole chunk C✓ Compute chunk’s digest h =H(C)✓ Read digest h from memory✓ Compare digests
✓ h = h ⇒ OK✓ h = h ⇒ not OK
? What about write accesses?
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.63/88 Institut Mines-Telecom R. Pacalet April 21, 2020
How to check memory integrity?
✓ Group data in constant lenght chunks✓ Store chunks’ digests somewhere in memory✓ Upon read access
✓ Read whole chunk C✓ Compute chunk’s digest h =H(C)✓ Read digest h from memory✓ Compare digests
✓ h = h ⇒ OK✓ h = h ⇒ not OK
? What about write accesses?
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.63/88 Institut Mines-Telecom R. Pacalet April 21, 2020
How to check memory integrity?
✓ Group data in constant lenght chunks✓ Store chunks’ digests somewhere in memory✓ Upon read access
✓ Read whole chunk C✓ Compute chunk’s digest h =H(C)✓ Read digest h from memory✓ Compare digests
✓ h = h ⇒ OK✓ h = h ⇒ not OK
? What about write accesses?
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.63/88 Institut Mines-Telecom R. Pacalet April 21, 2020
How to check memory integrity?
✓ Upon write access✓ Read whole chunk C✓ Compute chunk’s digest before h =H(C) and after write h′ =H(C′)✓ Read digest h from memory✓ Compare digests
✓ h = h ⇒ OK, perform write, update h ← h′✓ h = h ⇒ not OK
But attacker can replace any chunk (spoofing) and its digest h!✓ Store digests on-chip
• Used in XBox 360 but not scalable
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.64/88 Institut Mines-Telecom R. Pacalet April 21, 2020
How to check memory integrity?
✓ Upon write access✓ Read whole chunk C✓ Compute chunk’s digest before h =H(C) and after write h′ =H(C′)✓ Read digest h from memory✓ Compare digests
✓ h = h ⇒ OK, perform write, update h ← h′✓ h = h ⇒ not OK
But attacker can replace any chunk (spoofing) and its digest h!✓ Store digests on-chip
• Used in XBox 360 but not scalable
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.64/88 Institut Mines-Telecom R. Pacalet April 21, 2020
How to check memory integrity?
✓ Upon write access✓ Read whole chunk C✓ Compute chunk’s digest before h =H(C) and after write h′ =H(C′)✓ Read digest h from memory✓ Compare digests
✓ h = h ⇒ OK, perform write, update h ← h′✓ h = h ⇒ not OK
But attacker can replace any chunk (spoofing) and its digest h!✓ Store digests on-chip
• Used in XBox 360 but not scalable
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.64/88 Institut Mines-Telecom R. Pacalet April 21, 2020
How to check memory integrity?
✓ Upon write access✓ Read whole chunk C✓ Compute chunk’s digest before h =H(C) and after write h′ =H(C′)✓ Read digest h from memory✓ Compare digests
✓ h = h ⇒ OK, perform write, update h ← h′✓ h = h ⇒ not OK
But attacker can replace any chunk (spoofing) and its digest h!✓ Store digests on-chip
• Used in XBox 360 but not scalable
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.64/88 Institut Mines-Telecom R. Pacalet April 21, 2020
How to check memory integrity?
✓ Upon write access✓ Read whole chunk C✓ Compute chunk’s digest before h =H(C) and after write h′ =H(C′)✓ Read digest h from memory✓ Compare digests
✓ h = h ⇒ OK, perform write, update h ← h′✓ h = h ⇒ not OK
But attacker can replace any chunk (spoofing) and its digest h!✓ Store digests on-chip
• Used in XBox 360 but not scalable
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.64/88 Institut Mines-Telecom R. Pacalet April 21, 2020
How to check memory integrity?
✓ Upon write access✓ Read whole chunk C✓ Compute chunk’s digest before h =H(C) and after write h′ =H(C′)✓ Read digest h from memory✓ Compare digests
✓ h = h ⇒ OK, perform write, update h ← h′✓ h = h ⇒ not OK
But attacker can replace any chunk (spoofing) and its digest h!✓ Store digests on-chip
• Used in XBox 360 but not scalable
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.64/88 Institut Mines-Telecom R. Pacalet April 21, 2020
How to check memory integrity?
✓ Upon write access✓ Read whole chunk C✓ Compute chunk’s digest before h =H(C) and after write h′ =H(C′)✓ Read digest h from memory✓ Compare digests
✓ h = h ⇒ OK, perform write, update h ← h′✓ h = h ⇒ not OK
But attacker can replace any chunk (spoofing) and its digest h!✓ Store digests on-chip
• Used in XBox 360 but not scalable
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.64/88 Institut Mines-Telecom R. Pacalet April 21, 2020
How to check memory integrity?
✓ Upon write access✓ Read whole chunk C✓ Compute chunk’s digest before h =H(C) and after write h′ =H(C′)✓ Read digest h from memory✓ Compare digests
✓ h = h ⇒ OK, perform write, update h ← h′✓ h = h ⇒ not OK
But attacker can replace any chunk (spoofing) and its digest h!✓ Store digests on-chip
• Used in XBox 360 but not scalable
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.64/88 Institut Mines-Telecom R. Pacalet April 21, 2020
How to check memory integrity?
✓ Upon write access✓ Read whole chunk C✓ Compute chunk’s digest before h =H(C) and after write h′ =H(C′)✓ Read digest h from memory✓ Compare digests
✓ h = h ⇒ OK, perform write, update h ← h′✓ h = h ⇒ not OK
But attacker can replace any chunk (spoofing) and its digest h!✓ Store digests on-chip
• Used in XBox 360 but not scalable
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.64/88 Institut Mines-Telecom R. Pacalet April 21, 2020
How to check memory integrity?
✓ Upon write access✓ Read whole chunk C✓ Compute chunk’s digest before h =H(C) and after write h′ =H(C′)✓ Read digest h from memory✓ Compare digests
✓ h = h ⇒ OK, perform write, update h ← h′✓ h = h ⇒ not OK
But attacker can replace any chunk (spoofing) and its digest h!✓ Store digests on-chip
• Used in XBox 360 but not scalable
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.64/88 Institut Mines-Telecom R. Pacalet April 21, 2020
How to check memory integrity?
✓ Use keyed hash functions or Message Authentication Codes (MACs)✓ A bit like hash functions✓ But computation requires a secret key✓ e.g. last block of block cipher in CBC-MAC✓ Attacker cannot compute digest h of forged chunk✓ Spoofing detected? Does it detect splicing?
Ek Ek Ek Ek Ek Ek Ek Ek Ek Ek
C1
B2
C2
B3
C3
B1B0
C0
Bn−1
Cn−1
B2 B3B1B0 Bn−1
h
IV IV = 0
CBC mode of a block cipher CBC-MAC
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.65/88 Institut Mines-Telecom R. Pacalet April 21, 2020
How to check memory integrity?
✓ Use keyed hash functions or Message Authentication Codes (MACs)✓ A bit like hash functions✓ But computation requires a secret key✓ e.g. last block of block cipher in CBC-MAC✓ Attacker cannot compute digest h of forged chunk✓ Spoofing detected? Does it detect splicing?
Ek Ek Ek Ek Ek Ek Ek Ek Ek Ek
C1
B2
C2
B3
C3
B1B0
C0
Bn−1
Cn−1
B2 B3B1B0 Bn−1
h
IV IV = 0
CBC mode of a block cipher CBC-MAC
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.65/88 Institut Mines-Telecom R. Pacalet April 21, 2020
How to check memory integrity?
✓ Use keyed hash functions or Message Authentication Codes (MACs)✓ A bit like hash functions✓ But computation requires a secret key✓ e.g. last block of block cipher in CBC-MAC✓ Attacker cannot compute digest h of forged chunk✓ Spoofing detected? Does it detect splicing?
Ek Ek Ek Ek Ek Ek Ek Ek Ek Ek
C1
B2
C2
B3
C3
B1B0
C0
Bn−1
Cn−1
B2 B3B1B0 Bn−1
h
IV IV = 0
CBC mode of a block cipher CBC-MAC
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.65/88 Institut Mines-Telecom R. Pacalet April 21, 2020
How to check memory integrity?
✓ Use keyed hash functions or Message Authentication Codes (MACs)✓ A bit like hash functions✓ But computation requires a secret key✓ e.g. last block of block cipher in CBC-MAC✓ Attacker cannot compute digest h of forged chunk✓ Spoofing detected? Does it detect splicing?
Ek Ek Ek Ek Ek Ek Ek Ek Ek Ek
C1
B2
C2
B3
C3
B1B0
C0
Bn−1
Cn−1
B2 B3B1B0 Bn−1
h
IV IV = 0
CBC mode of a block cipher CBC-MAC
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.65/88 Institut Mines-Telecom R. Pacalet April 21, 2020
How to check memory integrity?
✓ Use keyed hash functions or Message Authentication Codes (MACs)✓ A bit like hash functions✓ But computation requires a secret key✓ e.g. last block of block cipher in CBC-MAC✓ Attacker cannot compute digest h of forged chunk✓ Spoofing detected? Does it detect splicing?
Ek Ek Ek Ek Ek Ek Ek Ek Ek Ek
C1
B2
C2
B3
C3
B1B0
C0
Bn−1
Cn−1
B2 B3B1B0 Bn−1
h
IV IV = 0
CBC mode of a block cipher CBC-MAC
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.65/88 Institut Mines-Telecom R. Pacalet April 21, 2020
How to check memory integrity?
✓ Use keyed hash functions or Message Authentication Codes (MACs)✓ A bit like hash functions✓ But computation requires a secret key✓ e.g. last block of block cipher in CBC-MAC✓ Attacker cannot compute digest h of forged chunk✓ Spoofing detected? Does it detect splicing?
Ek Ek Ek Ek Ek Ek Ek Ek Ek Ek
C1
B2
C2
B3
C3
B1B0
C0
Bn−1
Cn−1
B2 B3B1B0 Bn−1
h
IV IV = 0
CBC mode of a block cipher CBC-MAC
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.65/88 Institut Mines-Telecom R. Pacalet April 21, 2020
How to check memory integrity?
✓ Use keyed hash functions or Message Authentication Codes (MACs)✓ A bit like hash functions✓ But computation requires a secret key✓ e.g. last block of block cipher in CBC-MAC✓ Attacker cannot compute digest h of forged chunk✓ Spoofing detected? Does it detect splicing?
Ek Ek Ek Ek Ek Ek Ek Ek Ek Ek
C1
B2
C2
B3
C3
B1B0
C0
Bn−1
Cn−1
B2 B3B1B0 Bn−1
h
IV IV = 0
CBC mode of a block cipher CBC-MAC
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.65/88 Institut Mines-Telecom R. Pacalet April 21, 2020
How to check memory integrity?
✓ Use keyed hash functions or Message Authentication Codes (MACs)✓ A bit like hash functions✓ But computation requires a secret key✓ e.g. last block of block cipher in CBC-MAC✓ Attacker cannot compute digest h of forged chunk✓ Spoofing detected? Does it detect splicing?
Ek Ek Ek Ek Ek Ek Ek Ek Ek Ek
C1
B2
C2
B3
C3
B1B0
C0
Bn−1
Cn−1
B2 B3B1B0 Bn−1
h
IV IV = 0
CBC mode of a block cipher CBC-MAC
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.65/88 Institut Mines-Telecom R. Pacalet April 21, 2020
How to check memory integrity?
MACs stored in external memory cannot detect splicing• Attacker can swap data chunks C1,C2 and their digests h1,h2 without being detected
✓ Blend chunk’s address in digest computation✓ Use CBC-MACs with chunk’s address as first block
✓ Splicing detected? Does it detect replay?
Ek Ek Ek EkEk
B0
Ek
B2 B3B1 Bn−1
IV = 0
@
h
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.66/88 Institut Mines-Telecom R. Pacalet April 21, 2020
How to check memory integrity?
MACs stored in external memory cannot detect splicing• Attacker can swap data chunks C1,C2 and their digests h1,h2 without being detected
✓ Blend chunk’s address in digest computation✓ Use CBC-MACs with chunk’s address as first block
✓ Splicing detected? Does it detect replay?
Ek Ek Ek EkEk
B0
Ek
B2 B3B1 Bn−1
IV = 0
@
h
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.66/88 Institut Mines-Telecom R. Pacalet April 21, 2020
How to check memory integrity?
MACs stored in external memory cannot detect splicing• Attacker can swap data chunks C1,C2 and their digests h1,h2 without being detected
✓ Blend chunk’s address in digest computation✓ Use CBC-MACs with chunk’s address as first block
✓ Splicing detected? Does it detect replay?
Ek Ek Ek EkEk
B0
Ek
B2 B3B1 Bn−1
IV = 0
@
h
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.66/88 Institut Mines-Telecom R. Pacalet April 21, 2020
How to check memory integrity?
MACs stored in external memory cannot detect splicing• Attacker can swap data chunks C1,C2 and their digests h1,h2 without being detected
✓ Blend chunk’s address in digest computation✓ Use CBC-MACs with chunk’s address as first block
✓ Splicing detected? Does it detect replay?
Ek Ek Ek EkEk
B0
Ek
B2 B3B1 Bn−1
IV = 0
@
h
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.66/88 Institut Mines-Telecom R. Pacalet April 21, 2020
How to check memory integrity?
MACs stored in external memory cannot detect splicing• Attacker can swap data chunks C1,C2 and their digests h1,h2 without being detected
✓ Blend chunk’s address in digest computation✓ Use CBC-MACs with chunk’s address as first block
✓ Splicing detected? Does it detect replay?
Ek Ek Ek EkEk
B0
Ek
B2 B3B1 Bn−1
IV = 0
@
h
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.66/88 Institut Mines-Telecom R. Pacalet April 21, 2020
How to check memory integrity?
MACs stored in external memory cannot detect splicing• Attacker can swap data chunks C1,C2 and their digests h1,h2 without being detected
✓ Blend chunk’s address in digest computation✓ Use CBC-MACs with chunk’s address as first block
✓ Splicing detected? Does it detect replay?
Ek Ek Ek EkEk
B0
Ek
B2 B3B1 Bn−1
IV = 0
@
h
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.66/88 Institut Mines-Telecom R. Pacalet April 21, 2020
How to check memory integrity?
MACs stored in external memory cannot detect splicing• Attacker can swap data chunks C1,C2 and their digests h1,h2 without being detected
✓ Blend chunk’s address in digest computation✓ Use CBC-MACs with chunk’s address as first block
✓ Splicing detected? Does it detect replay?
Ek Ek Ek EkEk
B0
Ek
B2 B3B1 Bn−1
IV = 0
@
h
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.66/88 Institut Mines-Telecom R. Pacalet April 21, 2020
How to check memory integrity?
MACs stored in external memory cannot detect replay, even with address involved✓ Upon every memory access CPU computes digest of entire memory, compares with
internal reference and updates reference (if write access)• Computationally infeasible• Computing digest implies reading entire memory• Huge, inacceptable, performance degradation
✓ Use Merkle hash trees to reduce overhead
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.67/88 Institut Mines-Telecom R. Pacalet April 21, 2020
How to check memory integrity?
MACs stored in external memory cannot detect replay, even with address involved✓ Upon every memory access CPU computes digest of entire memory, compares with
internal reference and updates reference (if write access)• Computationally infeasible• Computing digest implies reading entire memory• Huge, inacceptable, performance degradation
✓ Use Merkle hash trees to reduce overhead
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.67/88 Institut Mines-Telecom R. Pacalet April 21, 2020
How to check memory integrity?
MACs stored in external memory cannot detect replay, even with address involved✓ Upon every memory access CPU computes digest of entire memory, compares with
internal reference and updates reference (if write access)• Computationally infeasible• Computing digest implies reading entire memory• Huge, inacceptable, performance degradation
✓ Use Merkle hash trees to reduce overhead
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.67/88 Institut Mines-Telecom R. Pacalet April 21, 2020
How to check memory integrity?
MACs stored in external memory cannot detect replay, even with address involved✓ Upon every memory access CPU computes digest of entire memory, compares with
internal reference and updates reference (if write access)• Computationally infeasible• Computing digest implies reading entire memory• Huge, inacceptable, performance degradation
✓ Use Merkle hash trees to reduce overhead
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.67/88 Institut Mines-Telecom R. Pacalet April 21, 2020
How to check memory integrity?
MACs stored in external memory cannot detect replay, even with address involved✓ Upon every memory access CPU computes digest of entire memory, compares with
internal reference and updates reference (if write access)• Computationally infeasible• Computing digest implies reading entire memory• Huge, inacceptable, performance degradation
✓ Use Merkle hash trees to reduce overhead
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.67/88 Institut Mines-Telecom R. Pacalet April 21, 2020
How to check memory integrity?
MACs stored in external memory cannot detect replay, even with address involved✓ Upon every memory access CPU computes digest of entire memory, compares with
internal reference and updates reference (if write access)• Computationally infeasible• Computing digest implies reading entire memory• Huge, inacceptable, performance degradation
✓ Use Merkle hash trees to reduce overhead
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.67/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Merkle hash trees
a2,0 a2,1
a1,0
a2,2 a2,3
a1,1
a0,0
an,2n−2 an,2n−1an,0 an,1
ai−1,⌊ j2 ⌋
=H(ai ,j ,ai ,j⊕1
)
Intermediatenodes, storedin memory
Root, stored on-chip
Memory data
Used as integrity checkers in secured file systems or peer-to-peer networks
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.68/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Merkle hash trees
a2,0 a2,1
a1,0
a2,2 a2,3
a1,1
a0,0
an,2n−2 an,2n−1an,0 an,1
ai−1,⌊ j2 ⌋
=H(ai ,j ,ai ,j⊕1
)
Intermediatenodes, storedin memory
Root, stored on-chip
Memory data
Used as integrity checkers in secured file systems or peer-to-peer networks
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.68/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Verified read and write
1: ai ,j ←Read(i , j)2: a← ai ,j3: while i > 0 do4: f = j ⊕15: p = ⌊ j
2 ⌋6: ai ,f ←Read(i , f )7: ai−1,p ←Read(i −1,p) ▷ h8: h ←H(ai ,min(j ,f ) ,ai ,max(j ,f ))
9: if ai−1,p = h then10: error11: end if12: i ← i −113: j ← p14: end while15: return a=VerifiedRead(i , j)
1: if i > 0 then2: f = j ⊕13: p = ⌊ j
2 ⌋4: ai ,f ←VerifiedRead(i , f )5: ai−1,p ←H(ai ,min(j ,f ) ,ai ,max(j ,f ))
6: VerifiedWrite(ai−1,p , i −1,p)7: end if8: Write(ai ,j , i , j)
H: hash or MAC functionRead(i , j),Write(i , j):regular read-write
? Optimize the verified read
Source: Ronan Keryell
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.69/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Verified read and write
1: ai ,j ←Read(i , j)2: a← ai ,j3: while i > 0 do4: f = j ⊕15: p = ⌊ j
2 ⌋6: ai ,f ←Read(i , f )7: ai−1,p ←Read(i −1,p) ▷ h8: h ←H(ai ,min(j ,f ) ,ai ,max(j ,f ))
9: if ai−1,p = h then10: error11: end if12: i ← i −113: j ← p14: end while15: return a=VerifiedRead(i , j)
1: if i > 0 then2: f = j ⊕13: p = ⌊ j
2 ⌋4: ai ,f ←VerifiedRead(i , f )5: ai−1,p ←H(ai ,min(j ,f ) ,ai ,max(j ,f ))
6: VerifiedWrite(ai−1,p , i −1,p)7: end if8: Write(ai ,j , i , j)
H: hash or MAC functionRead(i , j),Write(i , j):regular read-write
? Optimize the verified read
Source: Ronan Keryell
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.69/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Verified read and write
1: ai ,j ←Read(i , j)2: a← ai ,j3: while i > 0 do4: f = j ⊕15: p = ⌊ j
2 ⌋6: ai ,f ←Read(i , f )7: ai−1,p ←Read(i −1,p) ▷ h8: h ←H(ai ,min(j ,f ) ,ai ,max(j ,f ))
9: if ai−1,p = h then10: error11: end if12: i ← i −113: j ← p14: end while15: return a=VerifiedRead(i , j)
1: if i > 0 then2: f = j ⊕13: p = ⌊ j
2 ⌋4: ai ,f ←VerifiedRead(i , f )5: ai−1,p ←H(ai ,min(j ,f ) ,ai ,max(j ,f ))
6: VerifiedWrite(ai−1,p , i −1,p)7: end if8: Write(ai ,j , i , j)
H: hash or MAC functionRead(i , j),Write(i , j):regular read-write
? Optimize the verified read
Source: Ronan Keryell
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.69/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Verified read and write
1: ai ,j ←Read(i , j)2: a← ai ,j3: while i > 0 do4: f = j ⊕15: p = ⌊ j
2 ⌋6: ai ,f ←Read(i , f )7: ai−1,p ←Read(i −1,p) ▷ h8: h ←H(ai ,min(j ,f ) ,ai ,max(j ,f ))
9: if ai−1,p = h then10: error11: end if12: i ← i −113: j ← p14: end while15: return a=VerifiedRead(i , j)
1: if i > 0 then2: f = j ⊕13: p = ⌊ j
2 ⌋4: ai ,f ←VerifiedRead(i , f )5: ai−1,p ←H(ai ,min(j ,f ) ,ai ,max(j ,f ))
6: VerifiedWrite(ai−1,p , i −1,p)7: end if8: Write(ai ,j , i , j)
H: hash or MAC functionRead(i , j),Write(i , j):regular read-write
? Optimize the verified read
Source: Ronan Keryell
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.69/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Verified read and write
1: ai ,j ←Read(i , j)2: a← ai ,j3: while i > 0 do4: f = j ⊕15: p = ⌊ j
2 ⌋6: ai ,f ←Read(i , f )7: ai−1,p ←Read(i −1,p) ▷ h8: h ←H(ai ,min(j ,f ) ,ai ,max(j ,f ))
9: if ai−1,p = h then10: error11: end if12: i ← i −113: j ← p14: end while15: return a=VerifiedRead(i , j)
1: if i > 0 then2: f = j ⊕13: p = ⌊ j
2 ⌋4: ai ,f ←VerifiedRead(i , f )5: ai−1,p ←H(ai ,min(j ,f ) ,ai ,max(j ,f ))
6: VerifiedWrite(ai−1,p , i −1,p)7: end if8: Write(ai ,j , i , j)
H: hash or MAC functionRead(i , j),Write(i , j):regular read-write
? Optimize the verified read
Source: Ronan Keryell
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.69/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Verified read and write
1: ai ,j ←Read(i , j)2: a← ai ,j3: while i > 0 do4: f = j ⊕15: p = ⌊ j
2 ⌋6: ai ,f ←Read(i , f )7: ai−1,p ←Read(i −1,p) ▷ h8: h ←H(ai ,min(j ,f ) ,ai ,max(j ,f ))
9: if ai−1,p = h then10: error11: end if12: i ← i −113: j ← p14: end while15: return a=VerifiedRead(i , j)
1: if i > 0 then2: f = j ⊕13: p = ⌊ j
2 ⌋4: ai ,f ←VerifiedRead(i , f )5: ai−1,p ←H(ai ,min(j ,f ) ,ai ,max(j ,f ))
6: VerifiedWrite(ai−1,p , i −1,p)7: end if8: Write(ai ,j , i , j)
H: hash or MAC functionRead(i , j),Write(i , j):regular read-write
? Optimize the verified read
Source: Ronan Keryell
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.69/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Cost of replay detection
Hypothesis: Merkle nodes are 128 bits long, Merkle trees are binaryCost of integrity
• Memory to store Merkle trees: double the size of secured memory• Read latency: log2(n) times the standard read latency• Write latency: log2(n)2 times the standard write latency (can be reduced to log2(n) if
recursion is not used)
Example:• 1 Mbytes of secured memory, 16 bytes (128 bits) nodes• 216 leaves ⇒ n = 16• Total memory size: 2 Mbytes (216 +215 +214 + ...+21 +1)• One verified read = 17 reads• One verified write = 17 writes
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.70/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Cost of replay detection
Hypothesis: Merkle nodes are 128 bits long, Merkle trees are binaryCost of integrity
• Memory to store Merkle trees: double the size of secured memory• Read latency: log2(n) times the standard read latency• Write latency: log2(n)2 times the standard write latency (can be reduced to log2(n) if
recursion is not used)
Example:• 1 Mbytes of secured memory, 16 bytes (128 bits) nodes• 216 leaves ⇒ n = 16• Total memory size: 2 Mbytes (216 +215 +214 + ...+21 +1)• One verified read = 17 reads• One verified write = 17 writes
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.70/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Cost of replay detection
Hypothesis: Merkle nodes are 128 bits long, Merkle trees are binaryCost of integrity
• Memory to store Merkle trees: double the size of secured memory• Read latency: log2(n) times the standard read latency• Write latency: log2(n)2 times the standard write latency (can be reduced to log2(n) if
recursion is not used)
Example:• 1 Mbytes of secured memory, 16 bytes (128 bits) nodes• 216 leaves ⇒ n = 16• Total memory size: 2 Mbytes (216 +215 +214 + ...+21 +1)• One verified read = 17 reads• One verified write = 17 writes
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.70/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Cost of replay detection
Hypothesis: Merkle nodes are 128 bits long, Merkle trees are binaryCost of integrity
• Memory to store Merkle trees: double the size of secured memory• Read latency: log2(n) times the standard read latency• Write latency: log2(n)2 times the standard write latency (can be reduced to log2(n) if
recursion is not used)
Example:• 1 Mbytes of secured memory, 16 bytes (128 bits) nodes• 216 leaves ⇒ n = 16• Total memory size: 2 Mbytes (216 +215 +214 + ...+21 +1)• One verified read = 17 reads• One verified write = 17 writes
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.70/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Cost of replay detection
Hypothesis: Merkle nodes are 128 bits long, Merkle trees are binaryCost of integrity
• Memory to store Merkle trees: double the size of secured memory• Read latency: log2(n) times the standard read latency• Write latency: log2(n)2 times the standard write latency (can be reduced to log2(n) if
recursion is not used)
Example:• 1 Mbytes of secured memory, 16 bytes (128 bits) nodes• 216 leaves ⇒ n = 16• Total memory size: 2 Mbytes (216 +215 +214 + ...+21 +1)• One verified read = 17 reads• One verified write = 17 writes
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.70/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Cost of replay detection
Hypothesis: Merkle nodes are 128 bits long, Merkle trees are binaryCost of integrity
• Memory to store Merkle trees: double the size of secured memory• Read latency: log2(n) times the standard read latency• Write latency: log2(n)2 times the standard write latency (can be reduced to log2(n) if
recursion is not used)
Example:• 1 Mbytes of secured memory, 16 bytes (128 bits) nodes• 216 leaves ⇒ n = 16• Total memory size: 2 Mbytes (216 +215 +214 + ...+21 +1)• One verified read = 17 reads• One verified write = 17 writes
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.70/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Cost of replay detection
Hypothesis: Merkle nodes are 128 bits long, Merkle trees are binaryCost of integrity
• Memory to store Merkle trees: double the size of secured memory• Read latency: log2(n) times the standard read latency• Write latency: log2(n)2 times the standard write latency (can be reduced to log2(n) if
recursion is not used)
Example:• 1 Mbytes of secured memory, 16 bytes (128 bits) nodes• 216 leaves ⇒ n = 16• Total memory size: 2 Mbytes (216 +215 +214 + ...+21 +1)• One verified read = 17 reads• One verified write = 17 writes
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.70/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Cost of replay detection
Hypothesis: Merkle nodes are 128 bits long, Merkle trees are binaryCost of integrity
• Memory to store Merkle trees: double the size of secured memory• Read latency: log2(n) times the standard read latency• Write latency: log2(n)2 times the standard write latency (can be reduced to log2(n) if
recursion is not used)
Example:• 1 Mbytes of secured memory, 16 bytes (128 bits) nodes• 216 leaves ⇒ n = 16• Total memory size: 2 Mbytes (216 +215 +214 + ...+21 +1)• One verified read = 17 reads• One verified write = 17 writes
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.70/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Cost of replay detection
Hypothesis: Merkle nodes are 128 bits long, Merkle trees are binaryCost of integrity
• Memory to store Merkle trees: double the size of secured memory• Read latency: log2(n) times the standard read latency• Write latency: log2(n)2 times the standard write latency (can be reduced to log2(n) if
recursion is not used)
Example:• 1 Mbytes of secured memory, 16 bytes (128 bits) nodes• 216 leaves ⇒ n = 16• Total memory size: 2 Mbytes (216 +215 +214 + ...+21 +1)• One verified read = 17 reads• One verified write = 17 writes
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.70/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Cost of replay detection
Hypothesis: Merkle nodes are 128 bits long, Merkle trees are binaryCost of integrity
• Memory to store Merkle trees: double the size of secured memory• Read latency: log2(n) times the standard read latency• Write latency: log2(n)2 times the standard write latency (can be reduced to log2(n) if
recursion is not used)
Example:• 1 Mbytes of secured memory, 16 bytes (128 bits) nodes• 216 leaves ⇒ n = 16• Total memory size: 2 Mbytes (216 +215 +214 + ...+21 +1)• One verified read = 17 reads• One verified write = 17 writes
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.70/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Cost of replay detection
Hypothesis: Merkle nodes are 128 bits long, Merkle trees are binaryCost of integrity
• Memory to store Merkle trees: double the size of secured memory• Read latency: log2(n) times the standard read latency• Write latency: log2(n)2 times the standard write latency (can be reduced to log2(n) if
recursion is not used)
Example:• 1 Mbytes of secured memory, 16 bytes (128 bits) nodes• 216 leaves ⇒ n = 16• Total memory size: 2 Mbytes (216 +215 +214 + ...+21 +1)• One verified read = 17 reads• One verified write = 17 writes
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.70/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Cost of replay detection
Caches storing upper part of Merkle trees can speed up reads and writesExample:
• 1 Mbytes of secured memory, 16 bytes (128 bits) nodes• 216 leaves ⇒ n = 16• 8 first stages of Merkle trees stored in internal cache• Cache size: 28 nodes = 256×16= 4 k-bytes• Total memory size: ≈ 2 Mbytes• One verified read = 9 external reads, 8 internal reads• One verified write = 9 external writes, 8 internal writes
More on memory bodyguard in appendix
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.71/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Cost of replay detection
Caches storing upper part of Merkle trees can speed up reads and writesExample:
• 1 Mbytes of secured memory, 16 bytes (128 bits) nodes• 216 leaves ⇒ n = 16• 8 first stages of Merkle trees stored in internal cache• Cache size: 28 nodes = 256×16= 4 k-bytes• Total memory size: ≈ 2 Mbytes• One verified read = 9 external reads, 8 internal reads• One verified write = 9 external writes, 8 internal writes
More on memory bodyguard in appendix
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.71/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Cost of replay detection
Caches storing upper part of Merkle trees can speed up reads and writesExample:
• 1 Mbytes of secured memory, 16 bytes (128 bits) nodes• 216 leaves ⇒ n = 16• 8 first stages of Merkle trees stored in internal cache• Cache size: 28 nodes = 256×16= 4 k-bytes• Total memory size: ≈ 2 Mbytes• One verified read = 9 external reads, 8 internal reads• One verified write = 9 external writes, 8 internal writes
More on memory bodyguard in appendix
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.71/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Cost of replay detection
Caches storing upper part of Merkle trees can speed up reads and writesExample:
• 1 Mbytes of secured memory, 16 bytes (128 bits) nodes• 216 leaves ⇒ n = 16• 8 first stages of Merkle trees stored in internal cache• Cache size: 28 nodes = 256×16= 4 k-bytes• Total memory size: ≈ 2 Mbytes• One verified read = 9 external reads, 8 internal reads• One verified write = 9 external writes, 8 internal writes
More on memory bodyguard in appendix
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.71/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Cost of replay detection
Caches storing upper part of Merkle trees can speed up reads and writesExample:
• 1 Mbytes of secured memory, 16 bytes (128 bits) nodes• 216 leaves ⇒ n = 16• 8 first stages of Merkle trees stored in internal cache• Cache size: 28 nodes = 256×16= 4 k-bytes• Total memory size: ≈ 2 Mbytes• One verified read = 9 external reads, 8 internal reads• One verified write = 9 external writes, 8 internal writes
More on memory bodyguard in appendix
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.71/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Cost of replay detection
Caches storing upper part of Merkle trees can speed up reads and writesExample:
• 1 Mbytes of secured memory, 16 bytes (128 bits) nodes• 216 leaves ⇒ n = 16• 8 first stages of Merkle trees stored in internal cache• Cache size: 28 nodes = 256×16= 4 k-bytes• Total memory size: ≈ 2 Mbytes• One verified read = 9 external reads, 8 internal reads• One verified write = 9 external writes, 8 internal writes
More on memory bodyguard in appendix
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.71/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Cost of replay detection
Caches storing upper part of Merkle trees can speed up reads and writesExample:
• 1 Mbytes of secured memory, 16 bytes (128 bits) nodes• 216 leaves ⇒ n = 16• 8 first stages of Merkle trees stored in internal cache• Cache size: 28 nodes = 256×16= 4 k-bytes• Total memory size: ≈ 2 Mbytes• One verified read = 9 external reads, 8 internal reads• One verified write = 9 external writes, 8 internal writes
More on memory bodyguard in appendix
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.71/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Cost of replay detection
Caches storing upper part of Merkle trees can speed up reads and writesExample:
• 1 Mbytes of secured memory, 16 bytes (128 bits) nodes• 216 leaves ⇒ n = 16• 8 first stages of Merkle trees stored in internal cache• Cache size: 28 nodes = 256×16= 4 k-bytes• Total memory size: ≈ 2 Mbytes• One verified read = 9 external reads, 8 internal reads• One verified write = 9 external writes, 8 internal writes
More on memory bodyguard in appendix
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.71/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Cost of replay detection
Caches storing upper part of Merkle trees can speed up reads and writesExample:
• 1 Mbytes of secured memory, 16 bytes (128 bits) nodes• 216 leaves ⇒ n = 16• 8 first stages of Merkle trees stored in internal cache• Cache size: 28 nodes = 256×16= 4 k-bytes• Total memory size: ≈ 2 Mbytes• One verified read = 9 external reads, 8 internal reads• One verified write = 9 external writes, 8 internal writes
More on memory bodyguard in appendix
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.71/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Cost of replay detection
Caches storing upper part of Merkle trees can speed up reads and writesExample:
• 1 Mbytes of secured memory, 16 bytes (128 bits) nodes• 216 leaves ⇒ n = 16• 8 first stages of Merkle trees stored in internal cache• Cache size: 28 nodes = 256×16= 4 k-bytes• Total memory size: ≈ 2 Mbytes• One verified read = 9 external reads, 8 internal reads• One verified write = 9 external writes, 8 internal writes
More on memory bodyguard in appendix
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.71/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Conclusion: a Trusted Computing Platform (TCP)
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.72/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Science fiction: a true TCP
What follows is pure fantasyThe future’s not ours to seeTechnical innovations could completely cancel current threats
• 3D integration• On-chip extra-large memories• Increasing gap between sampling rates and busses frequencies
Technical innovations could open new threatsAnyway, these are my own thoughts, feel free to disagree
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.73/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Science fiction: a true TCP
What follows is pure fantasyThe future’s not ours to seeTechnical innovations could completely cancel current threats
• 3D integration• On-chip extra-large memories• Increasing gap between sampling rates and busses frequencies
Technical innovations could open new threatsAnyway, these are my own thoughts, feel free to disagree
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.73/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Science fiction: a true TCP
What follows is pure fantasyThe future’s not ours to seeTechnical innovations could completely cancel current threats
• 3D integration• On-chip extra-large memories• Increasing gap between sampling rates and busses frequencies
Technical innovations could open new threatsAnyway, these are my own thoughts, feel free to disagree
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.73/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Science fiction: a true TCP
What follows is pure fantasyThe future’s not ours to seeTechnical innovations could completely cancel current threats
• 3D integration• On-chip extra-large memories• Increasing gap between sampling rates and busses frequencies
Technical innovations could open new threatsAnyway, these are my own thoughts, feel free to disagree
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.73/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Science fiction: a true TCP
What follows is pure fantasyThe future’s not ours to seeTechnical innovations could completely cancel current threats
• 3D integration• On-chip extra-large memories• Increasing gap between sampling rates and busses frequencies
Technical innovations could open new threatsAnyway, these are my own thoughts, feel free to disagree
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.73/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Science fiction: a true TCP
What follows is pure fantasyThe future’s not ours to seeTechnical innovations could completely cancel current threats
• 3D integration• On-chip extra-large memories• Increasing gap between sampling rates and busses frequencies
Technical innovations could open new threatsAnyway, these are my own thoughts, feel free to disagree
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.73/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Science fiction: a true TCP
What follows is pure fantasyThe future’s not ours to seeTechnical innovations could completely cancel current threats
• 3D integration• On-chip extra-large memories• Increasing gap between sampling rates and busses frequencies
Technical innovations could open new threatsAnyway, these are my own thoughts, feel free to disagree
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.73/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Science fiction: a true TCP
What follows is pure fantasyThe future’s not ours to seeTechnical innovations could completely cancel current threats
• 3D integration• On-chip extra-large memories• Increasing gap between sampling rates and busses frequencies
Technical innovations could open new threatsAnyway, these are my own thoughts, feel free to disagree
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.73/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Must have of a true TCP
Assume on-chip is secure• SoC internals are «naturally» protected (too expensive)• If your adversary is that powerful,...• Take however appropriate countermeasures against side channel and fault attacks
Hardware protections• Communication with external world• On-board bus sniffing (confidentiality)• On-board bus injection (integrity)• Most can be protected in software but... only if memory is trusted...
✓ On-chip hardware bodyguard between CPU and memory controller?
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.74/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Must have of a true TCP
Assume on-chip is secure• SoC internals are «naturally» protected (too expensive)• If your adversary is that powerful,...• Take however appropriate countermeasures against side channel and fault attacks
Hardware protections• Communication with external world• On-board bus sniffing (confidentiality)• On-board bus injection (integrity)• Most can be protected in software but... only if memory is trusted...
✓ On-chip hardware bodyguard between CPU and memory controller?
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.74/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Must have of a true TCP
Assume on-chip is secure• SoC internals are «naturally» protected (too expensive)• If your adversary is that powerful,...• Take however appropriate countermeasures against side channel and fault attacks
Hardware protections• Communication with external world• On-board bus sniffing (confidentiality)• On-board bus injection (integrity)• Most can be protected in software but... only if memory is trusted...
✓ On-chip hardware bodyguard between CPU and memory controller?
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.74/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Must have of a true TCP
Assume on-chip is secure• SoC internals are «naturally» protected (too expensive)• If your adversary is that powerful,...• Take however appropriate countermeasures against side channel and fault attacks
Hardware protections• Communication with external world• On-board bus sniffing (confidentiality)• On-board bus injection (integrity)• Most can be protected in software but... only if memory is trusted...
✓ On-chip hardware bodyguard between CPU and memory controller?
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.74/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Must have of a true TCP
Assume on-chip is secure• SoC internals are «naturally» protected (too expensive)• If your adversary is that powerful,...• Take however appropriate countermeasures against side channel and fault attacks
Hardware protections• Communication with external world• On-board bus sniffing (confidentiality)• On-board bus injection (integrity)• Most can be protected in software but... only if memory is trusted...
✓ On-chip hardware bodyguard between CPU and memory controller?
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.74/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Must have of a true TCP
Assume on-chip is secure• SoC internals are «naturally» protected (too expensive)• If your adversary is that powerful,...• Take however appropriate countermeasures against side channel and fault attacks
Hardware protections• Communication with external world• On-board bus sniffing (confidentiality)• On-board bus injection (integrity)• Most can be protected in software but... only if memory is trusted...
✓ On-chip hardware bodyguard between CPU and memory controller?
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.74/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Must have of a true TCP
Assume on-chip is secure• SoC internals are «naturally» protected (too expensive)• If your adversary is that powerful,...• Take however appropriate countermeasures against side channel and fault attacks
Hardware protections• Communication with external world• On-board bus sniffing (confidentiality)• On-board bus injection (integrity)• Most can be protected in software but... only if memory is trusted...
✓ On-chip hardware bodyguard between CPU and memory controller?
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.74/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Must have of a true TCP
Assume on-chip is secure• SoC internals are «naturally» protected (too expensive)• If your adversary is that powerful,...• Take however appropriate countermeasures against side channel and fault attacks
Hardware protections• Communication with external world• On-board bus sniffing (confidentiality)• On-board bus injection (integrity)• Most can be protected in software but... only if memory is trusted...
✓ On-chip hardware bodyguard between CPU and memory controller?
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.74/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Must have of a true TCP
Assume on-chip is secure• SoC internals are «naturally» protected (too expensive)• If your adversary is that powerful,...• Take however appropriate countermeasures against side channel and fault attacks
Hardware protections• Communication with external world• On-board bus sniffing (confidentiality)• On-board bus injection (integrity)• Most can be protected in software but... only if memory is trusted...
✓ On-chip hardware bodyguard between CPU and memory controller?
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.74/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Must have of a true TCP
Assume on-chip is secure• SoC internals are «naturally» protected (too expensive)• If your adversary is that powerful,...• Take however appropriate countermeasures against side channel and fault attacks
Hardware protections• Communication with external world• On-board bus sniffing (confidentiality)• On-board bus injection (integrity)• Most can be protected in software but... only if memory is trusted...
✓ On-chip hardware bodyguard between CPU and memory controller?
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.74/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Must have of a true TCP
Bodyguard does not protect against software exploits✓ Strong software kernel
✓ Tiny and simple (fewer bugs)✓ Deeply verified, maybe formally proven (the must)✓ In charge of critical tasks✓ Virtualization hyper visor, micro-kernel, TrustZone® monitor,...
✓ If software involved in bodyguard management ⇒Software Security Manager (SSM)✓ Both protected (integrity and confidentiality of sensitive data) by bodyguard
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.75/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Must have of a true TCP
Bodyguard does not protect against software exploits✓ Strong software kernel
✓ Tiny and simple (fewer bugs)✓ Deeply verified, maybe formally proven (the must)✓ In charge of critical tasks✓ Virtualization hyper visor, micro-kernel, TrustZone® monitor,...
✓ If software involved in bodyguard management ⇒Software Security Manager (SSM)✓ Both protected (integrity and confidentiality of sensitive data) by bodyguard
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.75/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Must have of a true TCP
Bodyguard does not protect against software exploits✓ Strong software kernel
✓ Tiny and simple (fewer bugs)✓ Deeply verified, maybe formally proven (the must)✓ In charge of critical tasks✓ Virtualization hyper visor, micro-kernel, TrustZone® monitor,...
✓ If software involved in bodyguard management ⇒Software Security Manager (SSM)✓ Both protected (integrity and confidentiality of sensitive data) by bodyguard
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.75/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Must have of a true TCP
Bodyguard does not protect against software exploits✓ Strong software kernel
✓ Tiny and simple (fewer bugs)✓ Deeply verified, maybe formally proven (the must)✓ In charge of critical tasks✓ Virtualization hyper visor, micro-kernel, TrustZone® monitor,...
✓ If software involved in bodyguard management ⇒Software Security Manager (SSM)✓ Both protected (integrity and confidentiality of sensitive data) by bodyguard
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.75/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Must have of a true TCP
Bodyguard does not protect against software exploits✓ Strong software kernel
✓ Tiny and simple (fewer bugs)✓ Deeply verified, maybe formally proven (the must)✓ In charge of critical tasks✓ Virtualization hyper visor, micro-kernel, TrustZone® monitor,...
✓ If software involved in bodyguard management ⇒Software Security Manager (SSM)✓ Both protected (integrity and confidentiality of sensitive data) by bodyguard
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.75/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Must have of a true TCP
Bodyguard does not protect against software exploits✓ Strong software kernel
✓ Tiny and simple (fewer bugs)✓ Deeply verified, maybe formally proven (the must)✓ In charge of critical tasks✓ Virtualization hyper visor, micro-kernel, TrustZone® monitor,...
✓ If software involved in bodyguard management ⇒Software Security Manager (SSM)✓ Both protected (integrity and confidentiality of sensitive data) by bodyguard
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.75/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Must have of a true TCP
Bodyguard does not protect against software exploits✓ Strong software kernel
✓ Tiny and simple (fewer bugs)✓ Deeply verified, maybe formally proven (the must)✓ In charge of critical tasks✓ Virtualization hyper visor, micro-kernel, TrustZone® monitor,...
✓ If software involved in bodyguard management ⇒Software Security Manager (SSM)✓ Both protected (integrity and confidentiality of sensitive data) by bodyguard
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.75/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Must have of a true TCP
Bodyguard does not protect against software exploits✓ Strong software kernel
✓ Tiny and simple (fewer bugs)✓ Deeply verified, maybe formally proven (the must)✓ In charge of critical tasks✓ Virtualization hyper visor, micro-kernel, TrustZone® monitor,...
✓ If software involved in bodyguard management ⇒Software Security Manager (SSM)✓ Both protected (integrity and confidentiality of sensitive data) by bodyguard
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.75/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Must have of a true TCP
Boot ROM, internal RAMeFusesRandom Number GeneratorBoot to boot integrity (including downgrade replay attack) is an issue
✓ On-chip non-volatile memory✓ Larger boot ROM and a trusted third party (smart card, network)
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.76/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Must have of a true TCP
Boot ROM, internal RAMeFusesRandom Number GeneratorBoot to boot integrity (including downgrade replay attack) is an issue
✓ On-chip non-volatile memory✓ Larger boot ROM and a trusted third party (smart card, network)
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.76/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Must have of a true TCP
Boot ROM, internal RAMeFusesRandom Number GeneratorBoot to boot integrity (including downgrade replay attack) is an issue
✓ On-chip non-volatile memory✓ Larger boot ROM and a trusted third party (smart card, network)
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.76/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Must have of a true TCP
Boot ROM, internal RAMeFusesRandom Number GeneratorBoot to boot integrity (including downgrade replay attack) is an issue
✓ On-chip non-volatile memory✓ Larger boot ROM and a trusted third party (smart card, network)
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.76/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Must have of a true TCP
Boot ROM, internal RAMeFusesRandom Number GeneratorBoot to boot integrity (including downgrade replay attack) is an issue
✓ On-chip non-volatile memory✓ Larger boot ROM and a trusted third party (smart card, network)
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.76/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Must have of a true TCP
Boot ROM, internal RAMeFusesRandom Number GeneratorBoot to boot integrity (including downgrade replay attack) is an issue
✓ On-chip non-volatile memory✓ Larger boot ROM and a trusted third party (smart card, network)
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.76/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Conclusion
A true TCP would have hundreds of applications• Digital Rights Management (but is this just feasible?)• Trustable cloud computing (not only storage)• Trustable remote third party (smartcard-like PC)
Technical solutions are not really mature• Software flaws• Bus enciphering is not sufficient• Limited bus integrity is not scalable and/or risky• Full bus integrity is expensive
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.77/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Conclusion
A true TCP would have hundreds of applications• Digital Rights Management (but is this just feasible?)• Trustable cloud computing (not only storage)• Trustable remote third party (smartcard-like PC)
Technical solutions are not really mature• Software flaws• Bus enciphering is not sufficient• Limited bus integrity is not scalable and/or risky• Full bus integrity is expensive
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.77/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Conclusion
A true TCP would have hundreds of applications• Digital Rights Management (but is this just feasible?)• Trustable cloud computing (not only storage)• Trustable remote third party (smartcard-like PC)
Technical solutions are not really mature• Software flaws• Bus enciphering is not sufficient• Limited bus integrity is not scalable and/or risky• Full bus integrity is expensive
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.77/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Conclusion
A true TCP would have hundreds of applications• Digital Rights Management (but is this just feasible?)• Trustable cloud computing (not only storage)• Trustable remote third party (smartcard-like PC)
Technical solutions are not really mature• Software flaws• Bus enciphering is not sufficient• Limited bus integrity is not scalable and/or risky• Full bus integrity is expensive
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.77/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Conclusion
A true TCP would have hundreds of applications• Digital Rights Management (but is this just feasible?)• Trustable cloud computing (not only storage)• Trustable remote third party (smartcard-like PC)
Technical solutions are not really mature• Software flaws• Bus enciphering is not sufficient• Limited bus integrity is not scalable and/or risky• Full bus integrity is expensive
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.77/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Conclusion
A true TCP would have hundreds of applications• Digital Rights Management (but is this just feasible?)• Trustable cloud computing (not only storage)• Trustable remote third party (smartcard-like PC)
Technical solutions are not really mature• Software flaws• Bus enciphering is not sufficient• Limited bus integrity is not scalable and/or risky• Full bus integrity is expensive
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.77/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Conclusion
A true TCP would have hundreds of applications• Digital Rights Management (but is this just feasible?)• Trustable cloud computing (not only storage)• Trustable remote third party (smartcard-like PC)
Technical solutions are not really mature• Software flaws• Bus enciphering is not sufficient• Limited bus integrity is not scalable and/or risky• Full bus integrity is expensive
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.77/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Conclusion
A true TCP would have hundreds of applications• Digital Rights Management (but is this just feasible?)• Trustable cloud computing (not only storage)• Trustable remote third party (smartcard-like PC)
Technical solutions are not really mature• Software flaws• Bus enciphering is not sufficient• Limited bus integrity is not scalable and/or risky• Full bus integrity is expensive
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.77/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Conclusion
A true TCP would have hundreds of applications• Digital Rights Management (but is this just feasible?)• Trustable cloud computing (not only storage)• Trustable remote third party (smartcard-like PC)
Technical solutions are not really mature• Software flaws• Bus enciphering is not sufficient• Limited bus integrity is not scalable and/or risky• Full bus integrity is expensive
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.77/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Conclusion
The performance and cost impact are criticalSecurity, like speed, is a matter of tradeoffs
• Inside ⇒fast and secure• Outside ⇒slow and insecure• Inside security is cheap, outside security is expensive
TCP will probably rely on several layers, from small and strongly secured to largeinsecureThere are also many philosophical, legal and social issues
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.78/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Conclusion
The performance and cost impact are criticalSecurity, like speed, is a matter of tradeoffs
• Inside ⇒fast and secure• Outside ⇒slow and insecure• Inside security is cheap, outside security is expensive
TCP will probably rely on several layers, from small and strongly secured to largeinsecureThere are also many philosophical, legal and social issues
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.78/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Conclusion
The performance and cost impact are criticalSecurity, like speed, is a matter of tradeoffs
• Inside ⇒fast and secure• Outside ⇒slow and insecure• Inside security is cheap, outside security is expensive
TCP will probably rely on several layers, from small and strongly secured to largeinsecureThere are also many philosophical, legal and social issues
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.78/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Conclusion
The performance and cost impact are criticalSecurity, like speed, is a matter of tradeoffs
• Inside ⇒fast and secure• Outside ⇒slow and insecure• Inside security is cheap, outside security is expensive
TCP will probably rely on several layers, from small and strongly secured to largeinsecureThere are also many philosophical, legal and social issues
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.78/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Conclusion
The performance and cost impact are criticalSecurity, like speed, is a matter of tradeoffs
• Inside ⇒fast and secure• Outside ⇒slow and insecure• Inside security is cheap, outside security is expensive
TCP will probably rely on several layers, from small and strongly secured to largeinsecureThere are also many philosophical, legal and social issues
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.78/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Conclusion
The performance and cost impact are criticalSecurity, like speed, is a matter of tradeoffs
• Inside ⇒fast and secure• Outside ⇒slow and insecure• Inside security is cheap, outside security is expensive
TCP will probably rely on several layers, from small and strongly secured to largeinsecureThere are also many philosophical, legal and social issues
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.78/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Conclusion
The performance and cost impact are criticalSecurity, like speed, is a matter of tradeoffs
• Inside ⇒fast and secure• Outside ⇒slow and insecure• Inside security is cheap, outside security is expensive
TCP will probably rely on several layers, from small and strongly secured to largeinsecureThere are also many philosophical, legal and social issues
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.78/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Thank you for your attention
And remember please Auguste Kerckhoffs’ principles (1883)• The system must be substantially, if not mathematically, undecipherable;• The system must not require secrecy and can be stolen by the enemy without causing
trouble;• It must be easy to communicate and remember the keys without requiring written notes, it
must also be easy to change or modify the keys with different participants;• The system ought to be compatible with telegraph communication;• The system must be portable, and its use must not require more than one person;• Finally, regarding the circumstances in which such system is applied, it must be easy to
use and must neither require stress of mind nor the knowledge of a long series of rules.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.79/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Thank you for your attention
And remember please Auguste Kerckhoffs’ principles (1883)• The system must be substantially, if not mathematically, undecipherable;• The system must not require secrecy and can be stolen by the enemy without causing
trouble;• It must be easy to communicate and remember the keys without requiring written notes, it
must also be easy to change or modify the keys with different participants;• The system ought to be compatible with telegraph communication;• The system must be portable, and its use must not require more than one person;• Finally, regarding the circumstances in which such system is applied, it must be easy to
use and must neither require stress of mind nor the knowledge of a long series of rules.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.79/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Thank you for your attention
And remember please Auguste Kerckhoffs’ principles (1883)• The system must be substantially, if not mathematically, undecipherable;• The system must not require secrecy and can be stolen by the enemy without causing
trouble;• It must be easy to communicate and remember the keys without requiring written notes, it
must also be easy to change or modify the keys with different participants;• The system ought to be compatible with telegraph communication;• The system must be portable, and its use must not require more than one person;• Finally, regarding the circumstances in which such system is applied, it must be easy to
use and must neither require stress of mind nor the knowledge of a long series of rules.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.79/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Thank you for your attention
And remember please Auguste Kerckhoffs’ principles (1883)• The system must be substantially, if not mathematically, undecipherable;• The system must not require secrecy and can be stolen by the enemy without causing
trouble;• It must be easy to communicate and remember the keys without requiring written notes, it
must also be easy to change or modify the keys with different participants;• The system ought to be compatible with telegraph communication;• The system must be portable, and its use must not require more than one person;• Finally, regarding the circumstances in which such system is applied, it must be easy to
use and must neither require stress of mind nor the knowledge of a long series of rules.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.79/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Thank you for your attention
And remember please Auguste Kerckhoffs’ principles (1883)• The system must be substantially, if not mathematically, undecipherable;• The system must not require secrecy and can be stolen by the enemy without causing
trouble;• It must be easy to communicate and remember the keys without requiring written notes, it
must also be easy to change or modify the keys with different participants;• The system ought to be compatible with telegraph communication;• The system must be portable, and its use must not require more than one person;• Finally, regarding the circumstances in which such system is applied, it must be easy to
use and must neither require stress of mind nor the knowledge of a long series of rules.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.79/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Thank you for your attention
And remember please Auguste Kerckhoffs’ principles (1883)• The system must be substantially, if not mathematically, undecipherable;• The system must not require secrecy and can be stolen by the enemy without causing
trouble;• It must be easy to communicate and remember the keys without requiring written notes, it
must also be easy to change or modify the keys with different participants;• The system ought to be compatible with telegraph communication;• The system must be portable, and its use must not require more than one person;• Finally, regarding the circumstances in which such system is applied, it must be easy to
use and must neither require stress of mind nor the knowledge of a long series of rules.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.79/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Thank you for your attention
And remember please Auguste Kerckhoffs’ principles (1883)• The system must be substantially, if not mathematically, undecipherable;• The system must not require secrecy and can be stolen by the enemy without causing
trouble;• It must be easy to communicate and remember the keys without requiring written notes, it
must also be easy to change or modify the keys with different participants;• The system ought to be compatible with telegraph communication;• The system must be portable, and its use must not require more than one person;• Finally, regarding the circumstances in which such system is applied, it must be easy to
use and must neither require stress of mind nor the knowledge of a long series of rules.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.79/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Summary
HWSec: the course. Questions?Probing attacks. Questions?
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.80/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Further Reading I
Stefan Mangard and Elisabeth Oswald and Thomas PoppPower Analysis Attacks: Revealing the Secrets of Smart CardsSpringer, 2007, 337 p.
Wolfgang Rankl and Wolfgang EffingSmart Card HandbookJohn Wiley and Sons, 2004, 1088 p.
Nadia Nedjah and Luiza de Macedo MourelleEmbedded Cryptographic Hardware: Design & SecurityNova Publishers, 2005, 255 p.
And a lot more in the library. . .
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.81/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Appendix / More about memory bodyguard
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.82/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Bodyguard: role
Filter memory accessesEnforce security policiesEncipher and decipherCheck integrity (spoofing, splicing and replay)Protect memory bus and only that (inter-process isolation, software exploits aretotally different issues)Details depend on target market constraints
• Store digests in internal memory ⇒limited amount of integrity-protected external memory(XBox 360)
• Merkle hash trees ⇒scalable• Software controlled («a la MMU») ⇒flexible• Hard-wired security policies ⇒simpler (XBox 360)• Embedded caches in bodyguard improve performance
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.83/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Bodyguard: role
Filter memory accessesEnforce security policiesEncipher and decipherCheck integrity (spoofing, splicing and replay)Protect memory bus and only that (inter-process isolation, software exploits aretotally different issues)Details depend on target market constraints
• Store digests in internal memory ⇒limited amount of integrity-protected external memory(XBox 360)
• Merkle hash trees ⇒scalable• Software controlled («a la MMU») ⇒flexible• Hard-wired security policies ⇒simpler (XBox 360)• Embedded caches in bodyguard improve performance
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.83/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Bodyguard: role
Filter memory accessesEnforce security policiesEncipher and decipherCheck integrity (spoofing, splicing and replay)Protect memory bus and only that (inter-process isolation, software exploits aretotally different issues)Details depend on target market constraints
• Store digests in internal memory ⇒limited amount of integrity-protected external memory(XBox 360)
• Merkle hash trees ⇒scalable• Software controlled («a la MMU») ⇒flexible• Hard-wired security policies ⇒simpler (XBox 360)• Embedded caches in bodyguard improve performance
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.83/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Bodyguard: role
Filter memory accessesEnforce security policiesEncipher and decipherCheck integrity (spoofing, splicing and replay)Protect memory bus and only that (inter-process isolation, software exploits aretotally different issues)Details depend on target market constraints
• Store digests in internal memory ⇒limited amount of integrity-protected external memory(XBox 360)
• Merkle hash trees ⇒scalable• Software controlled («a la MMU») ⇒flexible• Hard-wired security policies ⇒simpler (XBox 360)• Embedded caches in bodyguard improve performance
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.83/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Bodyguard: role
Filter memory accessesEnforce security policiesEncipher and decipherCheck integrity (spoofing, splicing and replay)Protect memory bus and only that (inter-process isolation, software exploits aretotally different issues)Details depend on target market constraints
• Store digests in internal memory ⇒limited amount of integrity-protected external memory(XBox 360)
• Merkle hash trees ⇒scalable• Software controlled («a la MMU») ⇒flexible• Hard-wired security policies ⇒simpler (XBox 360)• Embedded caches in bodyguard improve performance
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.83/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Bodyguard: role
Filter memory accessesEnforce security policiesEncipher and decipherCheck integrity (spoofing, splicing and replay)Protect memory bus and only that (inter-process isolation, software exploits aretotally different issues)Details depend on target market constraints
• Store digests in internal memory ⇒limited amount of integrity-protected external memory(XBox 360)
• Merkle hash trees ⇒scalable• Software controlled («a la MMU») ⇒flexible• Hard-wired security policies ⇒simpler (XBox 360)• Embedded caches in bodyguard improve performance
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.83/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Bodyguard: role
Filter memory accessesEnforce security policiesEncipher and decipherCheck integrity (spoofing, splicing and replay)Protect memory bus and only that (inter-process isolation, software exploits aretotally different issues)Details depend on target market constraints
• Store digests in internal memory ⇒limited amount of integrity-protected external memory(XBox 360)
• Merkle hash trees ⇒scalable• Software controlled («a la MMU») ⇒flexible• Hard-wired security policies ⇒simpler (XBox 360)• Embedded caches in bodyguard improve performance
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.83/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Bodyguard: role
Filter memory accessesEnforce security policiesEncipher and decipherCheck integrity (spoofing, splicing and replay)Protect memory bus and only that (inter-process isolation, software exploits aretotally different issues)Details depend on target market constraints
• Store digests in internal memory ⇒limited amount of integrity-protected external memory(XBox 360)
• Merkle hash trees ⇒scalable• Software controlled («a la MMU») ⇒flexible• Hard-wired security policies ⇒simpler (XBox 360)• Embedded caches in bodyguard improve performance
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.83/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Bodyguard: role
Filter memory accessesEnforce security policiesEncipher and decipherCheck integrity (spoofing, splicing and replay)Protect memory bus and only that (inter-process isolation, software exploits aretotally different issues)Details depend on target market constraints
• Store digests in internal memory ⇒limited amount of integrity-protected external memory(XBox 360)
• Merkle hash trees ⇒scalable• Software controlled («a la MMU») ⇒flexible• Hard-wired security policies ⇒simpler (XBox 360)• Embedded caches in bodyguard improve performance
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.83/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Bodyguard: role
Filter memory accessesEnforce security policiesEncipher and decipherCheck integrity (spoofing, splicing and replay)Protect memory bus and only that (inter-process isolation, software exploits aretotally different issues)Details depend on target market constraints
• Store digests in internal memory ⇒limited amount of integrity-protected external memory(XBox 360)
• Merkle hash trees ⇒scalable• Software controlled («a la MMU») ⇒flexible• Hard-wired security policies ⇒simpler (XBox 360)• Embedded caches in bodyguard improve performance
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.83/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Bodyguard: role
Filter memory accessesEnforce security policiesEncipher and decipherCheck integrity (spoofing, splicing and replay)Protect memory bus and only that (inter-process isolation, software exploits aretotally different issues)Details depend on target market constraints
• Store digests in internal memory ⇒limited amount of integrity-protected external memory(XBox 360)
• Merkle hash trees ⇒scalable• Software controlled («a la MMU») ⇒flexible• Hard-wired security policies ⇒simpler (XBox 360)• Embedded caches in bodyguard improve performance
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.83/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Bodyguard: constraints
No CPU modifications (acceptability very low in many cases)• Sees only physical addresses• Has no knowledge of process IDs, privilege levels,...• If such knowledge needed, must be provided by software
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.84/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Bodyguard: constraints
No CPU modifications (acceptability very low in many cases)• Sees only physical addresses• Has no knowledge of process IDs, privilege levels,...• If such knowledge needed, must be provided by software
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.84/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Bodyguard: constraints
No CPU modifications (acceptability very low in many cases)• Sees only physical addresses• Has no knowledge of process IDs, privilege levels,...• If such knowledge needed, must be provided by software
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.84/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Bodyguard: constraints
No CPU modifications (acceptability very low in many cases)• Sees only physical addresses• Has no knowledge of process IDs, privilege levels,...• If such knowledge needed, must be provided by software
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.84/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Bodyguard: performance
Confidentiality• Encipher and decipher on write and read• Increases memory latency
✓ Stream ciphers as one-time pad on read-only data✓ Block cipher in counter (address) mode✓ Simple ⊕✓ One-time pad computation hidden by read latency✓ One time...
✓ Block cipher in CBC mode on RW data? But how does bodyguard distinguish RO and RW?
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.85/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Bodyguard: performance
Confidentiality• Encipher and decipher on write and read• Increases memory latency
✓ Stream ciphers as one-time pad on read-only data✓ Block cipher in counter (address) mode✓ Simple ⊕✓ One-time pad computation hidden by read latency✓ One time...
✓ Block cipher in CBC mode on RW data? But how does bodyguard distinguish RO and RW?
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.85/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Bodyguard: performance
Confidentiality• Encipher and decipher on write and read• Increases memory latency
✓ Stream ciphers as one-time pad on read-only data✓ Block cipher in counter (address) mode✓ Simple ⊕✓ One-time pad computation hidden by read latency✓ One time...
✓ Block cipher in CBC mode on RW data? But how does bodyguard distinguish RO and RW?
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.85/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Bodyguard: performance
Confidentiality• Encipher and decipher on write and read• Increases memory latency
✓ Stream ciphers as one-time pad on read-only data✓ Block cipher in counter (address) mode✓ Simple ⊕✓ One-time pad computation hidden by read latency✓ One time...
✓ Block cipher in CBC mode on RW data? But how does bodyguard distinguish RO and RW?
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.85/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Bodyguard: performance
Confidentiality• Encipher and decipher on write and read• Increases memory latency
✓ Stream ciphers as one-time pad on read-only data✓ Block cipher in counter (address) mode✓ Simple ⊕✓ One-time pad computation hidden by read latency✓ One time...
✓ Block cipher in CBC mode on RW data? But how does bodyguard distinguish RO and RW?
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.85/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Bodyguard: performance
Confidentiality• Encipher and decipher on write and read• Increases memory latency
✓ Stream ciphers as one-time pad on read-only data✓ Block cipher in counter (address) mode✓ Simple ⊕✓ One-time pad computation hidden by read latency✓ One time...
✓ Block cipher in CBC mode on RW data? But how does bodyguard distinguish RO and RW?
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.85/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Bodyguard: performance
Confidentiality• Encipher and decipher on write and read• Increases memory latency
✓ Stream ciphers as one-time pad on read-only data✓ Block cipher in counter (address) mode✓ Simple ⊕✓ One-time pad computation hidden by read latency✓ One time...
✓ Block cipher in CBC mode on RW data? But how does bodyguard distinguish RO and RW?
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.85/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Bodyguard: performance
Confidentiality• Encipher and decipher on write and read• Increases memory latency
✓ Stream ciphers as one-time pad on read-only data✓ Block cipher in counter (address) mode✓ Simple ⊕✓ One-time pad computation hidden by read latency✓ One time...
✓ Block cipher in CBC mode on RW data? But how does bodyguard distinguish RO and RW?
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.85/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Bodyguard: performance
Confidentiality• Encipher and decipher on write and read• Increases memory latency
✓ Stream ciphers as one-time pad on read-only data✓ Block cipher in counter (address) mode✓ Simple ⊕✓ One-time pad computation hidden by read latency✓ One time...
✓ Block cipher in CBC mode on RW data? But how does bodyguard distinguish RO and RW?
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.85/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Bodyguard: performance
Confidentiality• Encipher and decipher on write and read• Increases memory latency
✓ Stream ciphers as one-time pad on read-only data✓ Block cipher in counter (address) mode✓ Simple ⊕✓ One-time pad computation hidden by read latency✓ One time...
✓ Block cipher in CBC mode on RW data? But how does bodyguard distinguish RO and RW?
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.85/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Bodyguard: performance
Integrity• Complex• Slow• Memory hungry
✓ Spoofing: Message Authentication Codes (MAC)✓ Splicing: MACs with addresses✓ Replay: the most difficult
✓ Internal digests memory: non scalable✓ Merkle hash trees: expensive✓ RO data not sensitive to replay? But how does bodyguard distinguish RO and RW?
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.86/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Bodyguard: performance
Integrity• Complex• Slow• Memory hungry
✓ Spoofing: Message Authentication Codes (MAC)✓ Splicing: MACs with addresses✓ Replay: the most difficult
✓ Internal digests memory: non scalable✓ Merkle hash trees: expensive✓ RO data not sensitive to replay? But how does bodyguard distinguish RO and RW?
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.86/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Bodyguard: performance
Integrity• Complex• Slow• Memory hungry
✓ Spoofing: Message Authentication Codes (MAC)✓ Splicing: MACs with addresses✓ Replay: the most difficult
✓ Internal digests memory: non scalable✓ Merkle hash trees: expensive✓ RO data not sensitive to replay? But how does bodyguard distinguish RO and RW?
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.86/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Bodyguard: performance
Integrity• Complex• Slow• Memory hungry
✓ Spoofing: Message Authentication Codes (MAC)✓ Splicing: MACs with addresses✓ Replay: the most difficult
✓ Internal digests memory: non scalable✓ Merkle hash trees: expensive✓ RO data not sensitive to replay? But how does bodyguard distinguish RO and RW?
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.86/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Bodyguard: performance
Integrity• Complex• Slow• Memory hungry
✓ Spoofing: Message Authentication Codes (MAC)✓ Splicing: MACs with addresses✓ Replay: the most difficult
✓ Internal digests memory: non scalable✓ Merkle hash trees: expensive✓ RO data not sensitive to replay? But how does bodyguard distinguish RO and RW?
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.86/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Bodyguard: performance
Integrity• Complex• Slow• Memory hungry
✓ Spoofing: Message Authentication Codes (MAC)✓ Splicing: MACs with addresses✓ Replay: the most difficult
✓ Internal digests memory: non scalable✓ Merkle hash trees: expensive✓ RO data not sensitive to replay? But how does bodyguard distinguish RO and RW?
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.86/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Bodyguard: performance
Integrity• Complex• Slow• Memory hungry
✓ Spoofing: Message Authentication Codes (MAC)✓ Splicing: MACs with addresses✓ Replay: the most difficult
✓ Internal digests memory: non scalable✓ Merkle hash trees: expensive✓ RO data not sensitive to replay? But how does bodyguard distinguish RO and RW?
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.86/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Bodyguard: performance
Integrity• Complex• Slow• Memory hungry
✓ Spoofing: Message Authentication Codes (MAC)✓ Splicing: MACs with addresses✓ Replay: the most difficult
✓ Internal digests memory: non scalable✓ Merkle hash trees: expensive✓ RO data not sensitive to replay? But how does bodyguard distinguish RO and RW?
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.86/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Bodyguard: performance
Integrity• Complex• Slow• Memory hungry
✓ Spoofing: Message Authentication Codes (MAC)✓ Splicing: MACs with addresses✓ Replay: the most difficult
✓ Internal digests memory: non scalable✓ Merkle hash trees: expensive✓ RO data not sensitive to replay? But how does bodyguard distinguish RO and RW?
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.86/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Bodyguard: performance
Integrity• Complex• Slow• Memory hungry
✓ Spoofing: Message Authentication Codes (MAC)✓ Splicing: MACs with addresses✓ Replay: the most difficult
✓ Internal digests memory: non scalable✓ Merkle hash trees: expensive✓ RO data not sensitive to replay? But how does bodyguard distinguish RO and RW?
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.86/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Bodyguard: performance
Integrity• Complex• Slow• Memory hungry
✓ Spoofing: Message Authentication Codes (MAC)✓ Splicing: MACs with addresses✓ Replay: the most difficult
✓ Internal digests memory: non scalable✓ Merkle hash trees: expensive✓ RO data not sensitive to replay? But how does bodyguard distinguish RO and RW?
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.86/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Bodyguard: performance
Separate confidentiality and integritySeparate RO and RW pages
• One-time pad and MACs with addresses for RO data• Block cipher and Merkle hash trees for RW data
Apply security only when neededMonolithic memory protection: simple but performance overheadFixed contiguous memory areas (RO/RW, confidential or not, integrity or not)Security policy on physical page basis (software involved)
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.87/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Bodyguard: performance
Separate confidentiality and integritySeparate RO and RW pages
• One-time pad and MACs with addresses for RO data• Block cipher and Merkle hash trees for RW data
Apply security only when neededMonolithic memory protection: simple but performance overheadFixed contiguous memory areas (RO/RW, confidential or not, integrity or not)Security policy on physical page basis (software involved)
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.87/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Bodyguard: performance
Separate confidentiality and integritySeparate RO and RW pages
• One-time pad and MACs with addresses for RO data• Block cipher and Merkle hash trees for RW data
Apply security only when neededMonolithic memory protection: simple but performance overheadFixed contiguous memory areas (RO/RW, confidential or not, integrity or not)Security policy on physical page basis (software involved)
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.87/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Bodyguard: performance
Separate confidentiality and integritySeparate RO and RW pages
• One-time pad and MACs with addresses for RO data• Block cipher and Merkle hash trees for RW data
Apply security only when neededMonolithic memory protection: simple but performance overheadFixed contiguous memory areas (RO/RW, confidential or not, integrity or not)Security policy on physical page basis (software involved)
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.87/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Bodyguard: performance
Separate confidentiality and integritySeparate RO and RW pages
• One-time pad and MACs with addresses for RO data• Block cipher and Merkle hash trees for RW data
Apply security only when neededMonolithic memory protection: simple but performance overheadFixed contiguous memory areas (RO/RW, confidential or not, integrity or not)Security policy on physical page basis (software involved)
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.87/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Bodyguard: performance
Separate confidentiality and integritySeparate RO and RW pages
• One-time pad and MACs with addresses for RO data• Block cipher and Merkle hash trees for RW data
Apply security only when neededMonolithic memory protection: simple but performance overheadFixed contiguous memory areas (RO/RW, confidential or not, integrity or not)Security policy on physical page basis (software involved)
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.87/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Bodyguard: performance
Separate confidentiality and integritySeparate RO and RW pages
• One-time pad and MACs with addresses for RO data• Block cipher and Merkle hash trees for RW data
Apply security only when neededMonolithic memory protection: simple but performance overheadFixed contiguous memory areas (RO/RW, confidential or not, integrity or not)Security policy on physical page basis (software involved)
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.87/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Bodyguard: performance
Separate confidentiality and integritySeparate RO and RW pages
• One-time pad and MACs with addresses for RO data• Block cipher and Merkle hash trees for RW data
Apply security only when neededMonolithic memory protection: simple but performance overheadFixed contiguous memory areas (RO/RW, confidential or not, integrity or not)Security policy on physical page basis (software involved)
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.87/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Bodyguard: important features
Offer security-performance trade-offsRun existing applications unmodifiedSupport security-aware applications
✓ Software managed bodyguard (SSM)✓ Unaware applications
✓ Default security policy applied by OS (e.g. on a linker sections basis)✓ Security policy specified at launch time
✓ Security-aware applications✓ Come with pre-defined security policies (e.g. on a linker sections basis)✓ Use the SSM Application Programming Interface (API) to dynamically specify security
policy of newly allocated memory pages✓ Can dynamically adapt their security policies
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.88/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Bodyguard: important features
Offer security-performance trade-offsRun existing applications unmodifiedSupport security-aware applications
✓ Software managed bodyguard (SSM)✓ Unaware applications
✓ Default security policy applied by OS (e.g. on a linker sections basis)✓ Security policy specified at launch time
✓ Security-aware applications✓ Come with pre-defined security policies (e.g. on a linker sections basis)✓ Use the SSM Application Programming Interface (API) to dynamically specify security
policy of newly allocated memory pages✓ Can dynamically adapt their security policies
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.88/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Bodyguard: important features
Offer security-performance trade-offsRun existing applications unmodifiedSupport security-aware applications
✓ Software managed bodyguard (SSM)✓ Unaware applications
✓ Default security policy applied by OS (e.g. on a linker sections basis)✓ Security policy specified at launch time
✓ Security-aware applications✓ Come with pre-defined security policies (e.g. on a linker sections basis)✓ Use the SSM Application Programming Interface (API) to dynamically specify security
policy of newly allocated memory pages✓ Can dynamically adapt their security policies
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.88/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Bodyguard: important features
Offer security-performance trade-offsRun existing applications unmodifiedSupport security-aware applications
✓ Software managed bodyguard (SSM)✓ Unaware applications
✓ Default security policy applied by OS (e.g. on a linker sections basis)✓ Security policy specified at launch time
✓ Security-aware applications✓ Come with pre-defined security policies (e.g. on a linker sections basis)✓ Use the SSM Application Programming Interface (API) to dynamically specify security
policy of newly allocated memory pages✓ Can dynamically adapt their security policies
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.88/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Bodyguard: important features
Offer security-performance trade-offsRun existing applications unmodifiedSupport security-aware applications
✓ Software managed bodyguard (SSM)✓ Unaware applications
✓ Default security policy applied by OS (e.g. on a linker sections basis)✓ Security policy specified at launch time
✓ Security-aware applications✓ Come with pre-defined security policies (e.g. on a linker sections basis)✓ Use the SSM Application Programming Interface (API) to dynamically specify security
policy of newly allocated memory pages✓ Can dynamically adapt their security policies
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.88/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Bodyguard: important features
Offer security-performance trade-offsRun existing applications unmodifiedSupport security-aware applications
✓ Software managed bodyguard (SSM)✓ Unaware applications
✓ Default security policy applied by OS (e.g. on a linker sections basis)✓ Security policy specified at launch time
✓ Security-aware applications✓ Come with pre-defined security policies (e.g. on a linker sections basis)✓ Use the SSM Application Programming Interface (API) to dynamically specify security
policy of newly allocated memory pages✓ Can dynamically adapt their security policies
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.88/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Bodyguard: important features
Offer security-performance trade-offsRun existing applications unmodifiedSupport security-aware applications
✓ Software managed bodyguard (SSM)✓ Unaware applications
✓ Default security policy applied by OS (e.g. on a linker sections basis)✓ Security policy specified at launch time
✓ Security-aware applications✓ Come with pre-defined security policies (e.g. on a linker sections basis)✓ Use the SSM Application Programming Interface (API) to dynamically specify security
policy of newly allocated memory pages✓ Can dynamically adapt their security policies
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.88/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Bodyguard: important features
Offer security-performance trade-offsRun existing applications unmodifiedSupport security-aware applications
✓ Software managed bodyguard (SSM)✓ Unaware applications
✓ Default security policy applied by OS (e.g. on a linker sections basis)✓ Security policy specified at launch time
✓ Security-aware applications✓ Come with pre-defined security policies (e.g. on a linker sections basis)✓ Use the SSM Application Programming Interface (API) to dynamically specify security
policy of newly allocated memory pages✓ Can dynamically adapt their security policies
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.88/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Bodyguard: important features
Offer security-performance trade-offsRun existing applications unmodifiedSupport security-aware applications
✓ Software managed bodyguard (SSM)✓ Unaware applications
✓ Default security policy applied by OS (e.g. on a linker sections basis)✓ Security policy specified at launch time
✓ Security-aware applications✓ Come with pre-defined security policies (e.g. on a linker sections basis)✓ Use the SSM Application Programming Interface (API) to dynamically specify security
policy of newly allocated memory pages✓ Can dynamically adapt their security policies
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.88/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Bodyguard: important features
Offer security-performance trade-offsRun existing applications unmodifiedSupport security-aware applications
✓ Software managed bodyguard (SSM)✓ Unaware applications
✓ Default security policy applied by OS (e.g. on a linker sections basis)✓ Security policy specified at launch time
✓ Security-aware applications✓ Come with pre-defined security policies (e.g. on a linker sections basis)✓ Use the SSM Application Programming Interface (API) to dynamically specify security
policy of newly allocated memory pages✓ Can dynamically adapt their security policies
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.88/88 Institut Mines-Telecom R. Pacalet April 21, 2020
Bodyguard: important features
Offer security-performance trade-offsRun existing applications unmodifiedSupport security-aware applications
✓ Software managed bodyguard (SSM)✓ Unaware applications
✓ Default security policy applied by OS (e.g. on a linker sections basis)✓ Security policy specified at launch time
✓ Security-aware applications✓ Come with pre-defined security policies (e.g. on a linker sections basis)✓ Use the SSM Application Programming Interface (API) to dynamically specify security
policy of newly allocated memory pages✓ Can dynamically adapt their security policies
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.88/88 Institut Mines-Telecom R. Pacalet April 21, 2020
![Reverse-Engineering of Hardware Circuits-0mmWhite-box cryptography Active shield against probing Countermeasure against probing attacks Hardware and software camou age [GMN+13] Jean-Luc](https://img.dokumen.tips/doc/110x75/601da3f9f043e65faa5dd91a/reverse-engineering-of-hardware-circuits-0mm-white-box-cryptography-active-shield.jpg)
