4 ms·

Absolutely possible, people reverse engineer parts of our chips and I'm pretty sure a well supplied failure analysis lab could do some of the work as well. It'

by smalley 14y ago

Absolutely possible, people reverse engineer parts of our chips and I'm pretty sure a well supplied failure analysis lab could do some of the work as well. It's certainly doable to reverse engineer out a cryptographic key from a chip, but most of the people who could afford to do this wouldn't really need to do so. Secure elements are typically substantially more protected than standard logic. The structures can be designed in a manner to be very difficult to access without damaging them rendering them unreadable. Such a cryptographic key would likely be scattered in pieces around the chip, delivered through winding busses below enough critical logic connections and power rails so that the chip wouldn't be as vulnerable to a focused ion beam attack or infrared analysis. This makes it difficult to observe without destroying enough of the chip that live examination would not be possible. There are also tricks that would be used to mitigate the risk of differential power attacks etc. The bigger threats to secure elements are sloppy design with DFT/DFM (Design For Test) features. Most complex chips have at a minimum a mechanism of connecting a large number of the designs flops to what's like a huge shift register. If you knew enough of the design you could try to locate the output of a block which has access to the secure value, scan in a vector that makes it easy to recover the value (e.g. an XOR element you can force to XOR with 0's) and scan it out. There are also other DFT feature like on-die logic analyzers, micro-breakpoint engines, code signing overrides etc. Virtually all of these features are physically disabled prior to volume manufacturing. If a company was sloppy this could expose things that shouldn't be exposed. There are other attacks as well though. If you could compromise the signing keys for the microcode delivered to a processor like a modern x86 processor you could change the behavior of instructions. With custom microcode you could catch and override basically any instruction (for example you could change where a LOAD instruction stores data or make ADD do jmp etc). You could definitely use something like that in a malicious manner.

yk 14y ago
What is a "focused ion beam attack"? ( Is it as cool as it sounds?)
- smalley 14y ago
  It is pretty cool technique. There are a few things you can do via FIBs but what I'm thinking of here involves cutting a very fine hole through carefully targeted areas of the chip to expose the element in question (or its wires) so we can observe them. We actually have had to do this for debugging a couple of times on 32nm chips (cutting down in and pico probing ). we mostly only got away with it because we had all the floor plans, masks, RTL, documentation and very fancy equipment though, it would have been very difficult otherwise.
- cnvogel 14y ago
  What's a focused ion beam? Ions are charged atoms. In Vacuum you take a small inlet of gas (only very little), or heat up a small piece of solid until it evaborates, depending on what type of atom you want to use. Then ionize it (e.g. having a white glowing hot piece of wire in the vincinity) then accelerate it. With electrodes and coils (like, e.g. used in old CRT TVs/monitors) you can form have a narrow, focused beam you can move around. This all has to be done in vacuum, because the beams will stop in (dense) air immediately. This is your "cannon" with which you can very precisely aim and shoot at a target. Where is this done? The microscopes used for the very delicate structures in modern microchips are normally electron microscope (not using light but electrons for imaging). They operate in a vacuum which is very handy, because in that vacuum the focused ion beams can operate. If you want to buy, ask your dealer for a "Focused Ion Beam Workstation", e.g. http://www.photonics.com/Article.aspx?AID=50359 http://www.photonics.com/Article.aspx?AID=50359. Have 100k€ - 1M€ to spend. ;-) What to do? So you have your chip in your electron microscope, and you know that buried below some other structure is a signal hidden from plain view (maybe on purpose on a secure chip, but maybe you are debugging your own design and it just happens that this is where you suspect the answer to why the chip is not operating as required). So you set your ion-beam to "heavy noble gas, e.g. Xeon" and shoot particles to drill a small hole until you have a trench down to the interesting signal. But that trench is not wide enough to allow your (huge!) probe needle to contact. You you switch to "deposit metal" and, with much less impact velocity for your particles, like with a small brush, you put in a conductive trace from within the trench to some part on the (still intact) silicon-dioxide protective layer on top of the chip. This is where you put your probe needle that can then access the buried signal.
rdl 14y ago
In the public/unclassified world, Flylogic (Chris Tarnovsky)has it down to about 3-6h to extract a key from a moderately protected device (TPM; generally FIPS 140-2 level 3 (physical), using about $1mm in equipment and one guy. This is after years of developing expertise in general, and spending maybe 2-3 months part-time attacking a single model of chip (although within a family, it looks like new models are usually quite similar in layout and protection mechanisms). Attacking modules instead of chips is a little harder, especially because the modules themselves are more expensive, so expending hundreds of them in early testing is more expensive. But, for a national organization, totally feasible. If you really want trusted computing, you need defense in depth; the devices need to be in a semi-trusted environment, so a theft/tamper event can be detected, and keys revoked, within the attack window. So, it's ultimately not possible in a feasible way for consumer-possessed devices (trusted computing for DRM); OTOH it works great in a server environment (if someone breaks in, you just invalidate all keys in the facility within a few hours). HSMs (which have more active tamper response) are a lot better than TPMs (which are purely passive). You could probably trust an HSM even if it falls into enemy hands, unless the enemy is the HSM designer or NSA, for less than $50mm. The problem is there's no decent HSM for less than about $15k now (Thales/SafeNet duopoly). And HSMs have had implementation bugs in the past.

by smalley 14y ago

yk 14y ago

What is a "focused ion beam attack"? ( Is it as cool as it sounds?)

smalley 14y ago
It is pretty cool technique. There are a few things you can do via FIBs but what I'm thinking of here involves cutting a very fine hole through carefully targeted areas of the chip to expose the element in question (or its wires) so we can observe them. We actually have had to do this for debugging a couple of times on 32nm chips (cutting down in and pico probing ). we mostly only got away with it because we had all the floor plans, masks, RTL, documentation and very fancy equipment though, it would have been very difficult otherwise.
cnvogel 14y ago
What's a focused ion beam? Ions are charged atoms. In Vacuum you take a small inlet of gas (only very little), or heat up a small piece of solid until it evaborates, depending on what type of atom you want to use. Then ionize it (e.g. having a white glowing hot piece of wire in the vincinity) then accelerate it. With electrodes and coils (like, e.g. used in old CRT TVs/monitors) you can form have a narrow, focused beam you can move around. This all has to be done in vacuum, because the beams will stop in (dense) air immediately. This is your "cannon" with which you can very precisely aim and shoot at a target. Where is this done? The microscopes used for the very delicate structures in modern microchips are normally electron microscope (not using light but electrons for imaging). They operate in a vacuum which is very handy, because in that vacuum the focused ion beams can operate. If you want to buy, ask your dealer for a "Focused Ion Beam Workstation", e.g. http://www.photonics.com/Article.aspx?AID=50359 http://www.photonics.com/Article.aspx?AID=50359. Have 100k€ - 1M€ to spend. ;-) What to do? So you have your chip in your electron microscope, and you know that buried below some other structure is a signal hidden from plain view (maybe on purpose on a secure chip, but maybe you are debugging your own design and it just happens that this is where you suspect the answer to why the chip is not operating as required). So you set your ion-beam to "heavy noble gas, e.g. Xeon" and shoot particles to drill a small hole until you have a trench down to the interesting signal. But that trench is not wide enough to allow your (huge!) probe needle to contact. You you switch to "deposit metal" and, with much less impact velocity for your particles, like with a small brush, you put in a conductive trace from within the trench to some part on the (still intact) silicon-dioxide protective layer on top of the chip. This is where you put your probe needle that can then access the buried signal.

rdl 14y ago

In the public/unclassified world, Flylogic (Chris Tarnovsky)has it down to about 3-6h to extract a key from a moderately protected device (TPM; generally FIPS 140-2 level 3 (physical), using about $1mm in equipment and one guy. This is after years of developing expertise in general, and spending maybe 2-3 months part-time attacking a single model of chip (although within a family, it looks like new models are usually quite similar in layout and protection mechanisms). Attacking modules instead of chips is a little harder, especially because the modules themselves are more expensive, so expending hundreds of them in early testing is more expensive. But, for a national organization, totally feasible. If you really want trusted computing, you need defense in depth; the devices need to be in a semi-trusted environment, so a theft/tamper event can be detected, and keys revoked, within the attack window. So, it's ultimately not possible in a feasible way for consumer-possessed devices (trusted computing for DRM); OTOH it works great in a server environment (if someone breaks in, you just invalidate all keys in the facility within a few hours). HSMs (which have more active tamper response) are a lot better than TPMs (which are purely passive). You could probably trust an HSM even if it falls into enemy hands, unless the enemy is the HSM designer or NSA, for less than $50mm. The problem is there's no decent HSM for less than about $15k now (Thales/SafeNet duopoly). And HSMs have had implementation bugs in the past.