Schneier on Security

DG • August 1, 2011 5:09 PM

This is the indirect response I got from Xilinx through a distributor after forwarding references to both papers to Xilinx (IACR 2011 papers 390 and 391):

• DPA attacks on semiconductor devices have been known and understood for at least 13 years.
• DPA attacks can be targeted at virtually all processors, microcontrollers, payment cards (‘smart cards’) as well as FPGA’s.
• To date, no field DPA attacks on Xilinx FPGA’s have been reported.

It is perhaps interesting to note that we are aware that a company that tries to sell security patents to semiconductor vendors has been distributing these research papers to editors…

While technically feasible, these techniques are not trivial to execute and require significant undetected access to the physical systems under attack, as well as specialized knowledge and equipment.

Xilinx takes all reports of security breaches extremely seriously; they continually add new features to protect the security of our devices.

Customers with concerns about the security of their design should implement a comprehensive security strategy to protect their architecture and design files, access to physical equipment, as well as any other measures they may deem appropriate.

I sent a few papers back on techniques to defeat DPA in particular

Reversible Logic to Cryptographic Hardware: A New Paradigm
Himanshu Thapliyal and Mark Zwolinski

A Novel and Highly Efficient AES Implementation Robust
against Differential Power Analysis
Massoud Masoumi
K. N. Toosi University of Tech., Tehran, Iran

There’s plenty of other work in the field.

The response was the equivalent of stating security is the responsibility of the Xilinx customer, and security is what you see or make yourself.

Unfortunately for the likes of Cisco, unlike military applications, unscreened customers are in regular possession of hardware containing FPGAs getting ‘securely’ configured.

This may not be the biggest threat to ‘IP’ capture when you consider most ‘piracy’ occurs in the supply chain. In a Cisco’s case the new attack focuses on the economics involved, cost versus return volume of ‘pirated’ ‘IP’ sold. Simply steps like controlled access during secure configuration loading into EEPROM linked to device serial numbers would no longer be a guarantee.

Think of it as a war of escalation between driving production costs down and the ease of ‘piracy’. What’s out of balance here is the production cost of the ‘IP’ duplication when counting on the encryption (that doesn’t really work) against the risk of duplication.

Xilinx will likely improve their story adding better protection or quit selling the feature. This is so reminiscent of DRM schemes which are vulnerable to ‘broken once duplicated many’ times attacks.

In the past we’ve seen networking products for instance where every spare FPGA pin is bused to neighboring devices allowing products to be re-manufactured by design changes represented by different programming configuration. I’d imagine a close examination would also show product differentiation done the same way, leaving cheaper products vulnerable to configuration upgrades.

High volume or high profit means high risk. Now will this drive vendor back toward ASICs or simply dilute markets with counterfeit goods for lower volume products with little physical differentiation?

DG • August 2, 2011 1:50 PM

“Practically, how does power analysis and similiar types of analysis work? How much knowledge do you need about the hardware? What could stop it from working?”

Massoud Masoumi’s paper A Novel and Highly Efficient AES Implementation Robust against Differential Power Analysis gives an outline of power analysis with emphasis on Differential Power Analysis (DPA) in Section 3. It’s based on the use of a hypothetical model of the algorithm and defensive techniques are aimed at disconnecting the power signatures from the theoretical model.

This paper describes one way to do it, the paper Reversible Logic to Cryptographic Hardware: A New Paradigm describes another using reversible logic.

The paper Lightweight Cryptography and DPA Countermeasures: A Survey (PDF) provides an overview of some techniques to defeat DPA. In a military environment one might expect EMI container encapsulation, power filters and split key access to cryptographic functions to prevent unauthorized access to devices in operation. You’d also imagine other countermeasures might be adopted, as well as need to postulate theoretical models for undisclosed Type I cryptographic algorithms.

Split secrets are also applicable in a commercial environment. Most counterfeiting is done by elements participating in a products supply chain. You could separate the FPGA configuration code loading from the rest of the supply chain requiring collusion between the two operators. The net result would be the need for actual cryptanalysis techniques such as DPA, where the value of such services would increase.

I’d suggest googling for “AES DPA”, where the emphasis is as in the present case on recovering keys from Advanced Encryption Standard implementations. Note the side bar Ad for DPA Resistant AES Core.