3 ms·
The concept of undervolting the chip, causing bitflips, to do a differential fault analysis[0] seems like a stroke of genius. I had no idea AES could be broken
by sva_ 5y ago
The concept of undervolting the chip, causing bitflips, to do a differential fault analysis[0] seems like a stroke of genius. I had no idea AES could be broken in such a fashion, of interfering with just the last 1-2 rounds of the cipher.
I wonder if it will be mitigated by requiring a larger minimum voltage?
[0] https://en.wikipedia.org/wiki/Differential_fault_analysis https://en.wikipedia.org/wiki/Differential_fault_analysis
- ParadisoShlee 5y agoThere is a series of videos on the ChipWhisper to recover RSA keys and other fault injection stuff. Super interesting security field.
- exikyut 5y agoHa, that mentions "DFA was also applied on AES", citing a 2005 reference. Is the OP article being understatedly humble? ;)
- Mindwipe 5y agoEither that or pausing crypto operations without the required voltage, but that reduces your fault tolerance.
- baybal2 5y ago> I wonder if it will be mitigated by requiring a larger minimum voltage? How would you detect low voltage without a reference voltage?
- hashimotonomora 5y agop-n junctions have a threshold forward voltage.
- frumiousirc 5y agowhich is temperature dependent
- baybal2 5y agoWhich will not tell you anything without knowing the body bias voltage on CMOS, which is set relative to power rails.
- 95014_refugee 5y agoHow do you think "reference voltages" work? (Also, temperature sensors. Sheesh people.)
- omegalulw 5y agoYou can put a diode and see if it turns or. Or manufacture a transistor with the specific gate voltage and see if that turns on. You would have to account for things like low inductance (to protect against short, sharp dips), etc. Obviously this is a very naive solution, but the point is you don't need a high enough reference voltage.
- labcomputer 5y agoResistor voltage divider on the power rail, plus a voltage reference that runs well below the minimum voltage of the part. Both go to a comparator, which outputs to whatever you want (like hold the part in power on reset)
- sdfgsdvf 5y agoVoltage glitching for secret/rom extraction has a long and storied history. It's the basis of how DirecTV cards were compromised in the late 90s/early 00s.
- Scoundreller 5y agoOr a good cover for the leakers
- monocasa 5y agoI've seen the technique reproduced enough that I'm pretty convinced it's not a cover.
- brokenmachine 5y agoIt's not a cover story in all cases. The best video about it that I've seen is from 33c3 https://youtu.be/lhbSD1Jba0Q https://youtu.be/lhbSD1Jba0Q He bought a carful of cable boxes and glitched them into submission using a NOP slide and custom code to extract the firmware, IIRC over I2C. It was an awesome talk and really explained it well!!
- nebula8804 5y agoThat was an amazing talk when it first came out. I didn't fully understand the process but I wish the speaker would do more talks. His clear Canadian accent and method of explanation is wonderful! Has anyone ever hacked DishNetwork/Echostar/Nagravision cards? 10+ years ago I was fascinated to learn about how the new at the time "Nagra3" cards worked so well. I never did find out how those things worked as they seemed impossible to break. I also vaguely remember the story of how Directv owners (owners of FOX networks) secretly commissioned some hackers in Israel to crack their competitors systems while at the same time securing their system further. They eventually got sued but paid a pittance in restitution while their competitors suffered serious financial issues. Really unethical behavior.
- sgjmdf 5y ago
- marcan_42 5y agoEnvironmental sensors are common in security critical hardware, but very hard to get right. The problem is that this doesn't work for high performance CPUs, so it can only really be done for things like TSEC or Apple's SEP. You need the CPU to have a large margin where it operates correctly, so the sensor doesn't have to be extremely fast and accurate (which is nigh impossible with on-chip sensors with no external reference). And even then it has to be able to detect things like microsecond-long dips in the supply voltage, or extreme temperatures, or a single clock pulse that's too short. It's really hard. Several years ago, I got the Wii U PowerPC boot ROM keys out by doing a self contained glitching attack like this. In that case it was a reset glitch, where I pulsed the reset line for less than the required 256 clock cycles (from the ARM core which controls it). At very specific pulse widths (that varied from device to device), that got the CPU into an inconsistent execution state that eventually fell out of the Boot ROM and into code I'd placed in RAM. That one could've easily been mitigated by a reset stretcher circuit, but it's another fun example of a "self-glitch" attack with no additional hardware.