3 ms·

Would this potentially enable pulling secrets (eg. HSM/disk encryption keys) from chips? My understanding is that the integrated security processor on something

by judge2020 5y ago

Would this potentially enable pulling secrets (eg. HSM/disk encryption keys) from chips? My understanding is that the integrated security processor on something like an AMD or Apple chip is permanent and stored directly on-chip, with the only thing preventing extraction of its secrets being the complexity in the traces that govern performing the cryptographic operations. I know Amd and Apple have their top talent involved in designing the chips are are probably ahead of the curve on attacks like this, but at a certain point we might have to grapple with a certain world power being able to pull secrets from consumer and enterprise electronics.

Kirby64 5y ago
HSM or disk encryption keys (e.g., the encryption keys in Apple silicon) should be stored in a space that is intended to be impervious from analysis techniques (SEM, X-ray, etc) and any deprocessing technique (acid removal, FIB, etc) will destroy the contents. It's built differently from traditional techniques. I suspect this fancy X-ray would not work either.
- gjvnq 5y ago
  Atomic scientists: what if I dissasamble it one atom at a time? :)
RantyDave 5y ago
AFAIK these secrets are written to the chip during manufacture in much the same way as you might write to flash. They are not described by the physical structure of the chip at all. Whether or not you can use X-ray or other probing techniques to find the current state of a cell of flash memory is a different question.
- zerohp 5y ago
  Efuses are more common and they change the physical structure when written, much like blowing a fuse in your car. Laser blown fuses are also common.
  - go_prodev 5y ago
    A blown fuse should be detectable with this method.
  - brohee 5y ago
    Efuse aren't typically used for secrets but more for stuff like public keys for firmware signature. Efuse always have been vulnerable to decapping so this doesn't change the landscape for them. OTOH, I think it changes the landscape for smart card secret extraction as it means you can get a full layout of the counter measures before attacking the chip...
hansvm 5y ago
With physical access to a chip the only barrier to accessing that information is analysis time (and the absurd amount of equipment required to analyze things that small), at least assuming no significant quantum weirdness is mandatory to the chip's operation (i.e., that classical physics with perhaps some simple quantum approximations suffice to roughly describe the system). If the chip is capable of performing cryptographic operations using certain keys, at a minimum you can produce a nand-level algorithm capable of performing those same cryptographic operations with those same keys. If the cryptographic operations in question are known to be of some common pattern (elliptic curves or what have you) then it's also trivial to, in the presence of that nand-level algorithm, deconstruct the secrets. That said, this tech doesn't look to be sufficient on its own. You probably need to analyze the contents of a chip, not just its structure. The linked article just describes an improvement in learning some kinds of physical structure.
- tgflynn 5y ago
  > With physical access to a chip the only barrier to accessing that information is analysis time > That said, this tech doesn't look to be sufficient on its own. You probably need to analyze the contents of a chip, not just its structure. Those two statements appear to be contradictory. Could you clarify what you mean by them and in particular what you mean by the "contents" of a chip ? I know that low voltage SEM used to be capable of seeing voltage differences in chips but I have no idea if that's still feasible with the scale of today's technology (resolution tends to be worse at lower beam voltages) and the physical basis for flash memory.
  - hansvm 5y ago
    By "contents" I did mean reading voltage differences. > Contradictory One statement is that if you control a chip you can produce the stated information eventually. The details are an engineering problem. The other statement is that this particular instance of engineering doesn't suffice I don't think. > SEM I'd be inclined to use EFM instead. Its resolution should suffice for the next few generations of chips.

Kirby64 5y ago

HSM or disk encryption keys (e.g., the encryption keys in Apple silicon) should be stored in a space that is intended to be impervious from analysis techniques (SEM, X-ray, etc) and any deprocessing technique (acid removal, FIB, etc) will destroy the contents. It's built differently from traditional techniques. I suspect this fancy X-ray would not work either.

gjvnq 5y ago
Atomic scientists: what if I dissasamble it one atom at a time? :)

RantyDave 5y ago

AFAIK these secrets are written to the chip during manufacture in much the same way as you might write to flash. They are not described by the physical structure of the chip at all. Whether or not you can use X-ray or other probing techniques to find the current state of a cell of flash memory is a different question.

zerohp 5y ago
Efuses are more common and they change the physical structure when written, much like blowing a fuse in your car. Laser blown fuses are also common.
- go_prodev 5y ago
  A blown fuse should be detectable with this method.
- brohee 5y ago
  Efuse aren't typically used for secrets but more for stuff like public keys for firmware signature. Efuse always have been vulnerable to decapping so this doesn't change the landscape for them. OTOH, I think it changes the landscape for smart card secret extraction as it means you can get a full layout of the counter measures before attacking the chip...

hansvm 5y ago

With physical access to a chip the only barrier to accessing that information is analysis time (and the absurd amount of equipment required to analyze things that small), at least assuming no significant quantum weirdness is mandatory to the chip's operation (i.e., that classical physics with perhaps some simple quantum approximations suffice to roughly describe the system). If the chip is capable of performing cryptographic operations using certain keys, at a minimum you can produce a nand-level algorithm capable of performing those same cryptographic operations with those same keys. If the cryptographic operations in question are known to be of some common pattern (elliptic curves or what have you) then it's also trivial to, in the presence of that nand-level algorithm, deconstruct the secrets. That said, this tech doesn't look to be sufficient on its own. You probably need to analyze the contents of a chip, not just its structure. The linked article just describes an improvement in learning some kinds of physical structure.

tgflynn 5y ago
> With physical access to a chip the only barrier to accessing that information is analysis time > That said, this tech doesn't look to be sufficient on its own. You probably need to analyze the contents of a chip, not just its structure. Those two statements appear to be contradictory. Could you clarify what you mean by them and in particular what you mean by the "contents" of a chip ? I know that low voltage SEM used to be capable of seeing voltage differences in chips but I have no idea if that's still feasible with the scale of today's technology (resolution tends to be worse at lower beam voltages) and the physical basis for flash memory.
- hansvm 5y ago
  By "contents" I did mean reading voltage differences. > Contradictory One statement is that if you control a chip you can produce the stated information eventually. The details are an engineering problem. The other statement is that this particular instance of engineering doesn't suffice I don't think. > SEM I'd be inclined to use EFM instead. Its resolution should suffice for the next few generations of chips.