BlackHat Japan ‘08
Karsten Nohl—Univ. of Virginia

Some material courtesy bunnie or Flylogic.

Source: New Yorker Lots of critical infrastructure relies on secure

hardware Smartcards for access control, payment tokens
 Satellite TV cards, car keys, printer cartridges, …

 Security often considered hard and expensive
 Hence, often excluded from initial design▪ Protection added after problems arise▪ Patchwork security is harder and more expensive!
Accurate security estimates neededfor risk assessment.
Karsten Nohl - Hardware Security2CryptographicCryptographic
Challenge- cipher
cipherresponse
protocolKarsten Nohl - Hardware Security

3

Cipher

CipherNear Field
Communication
phone
Backend ServerKarsten Nohl - Hardware Security

4

Encrypted .
data

Decrypted
data .

CipherKarsten Nohl - Hardware Security

5

Cipher

Karsten Nohl - Hardware Security

Cipher6

 Hardware security relies ona) Key storage

Cipherb) Cryptographic cipher (encryption)

Many systems fail to acknowledge lack of
secrecy in hardware“There are no secrets in silicon.” -bunnieThis talk discusses common weaknesses insecure key storage and proprietary encryption.
Karsten Nohl - Hardware Security7 Microchip Basics
 Reverse-engineering algorithms
 Finding secret ciphers Exploiting proprietary encryption

 Security of key storage Demo / Hands-on lab
Karsten Nohl - Hardware Security

8

Infineon SLE66, courtesy Flylogic

Karsten Nohl - Hardware Security10 Analyze chips using “last principles”
 Principle #1: Chips are structured▪ Crucial for design partitioning and refactoring Principle #2: Chips are designed to be read back▪ Enables prototyping and debugging

 Complement analysis with “first principle”
 Principle #3: Nothing can be hidden in silicon▪ Chips are self-contained; hence all data, programs, andalgorithms are available on the chip

Karsten Nohl - Hardware Security

11

Infineon SLE66, courtesy Flylogic

Karsten Nohl - Hardware Security

12

Infineon
SLE66
address/data bus, courtesy Flylogic
Karsten Nohl - Hardware
Security13 Can sometimes

protect data, but
not algorithms
Karsten Nohl - Hardware Security14 Most security systems use cryptography
 Too many use proprietary ciphers Many are weak, but secret We find cipher implementations from silicon Cheap approach, no crypto knowledge required We want to enable you to do the same
“No more weak ciphers. No more paranoia.”
Sean O’Neil

Karsten Nohl - Hardware Security16 Radio Frequency IDentification
 Tiny computer chips
 Passively Powered

Karsten Nohl - Hardware Security17 RFIDs are becoming ubiquitous Integrated in many security applications
 Payment, Access Control

 Passports, Car Ignition
 Implants, …

RFIDs will be universalidentifier. Might replace
passwords, PINs, andfingerprints.
Karsten Nohl - Hardware Security

18

MifareNo Crypto

TU Graz [‘05] Passports???
Karsten Nohl - Hardware Security

AES

RSA19

 NXP claimed high security:
 “approved authentication”
 “advanced security levels”

 Specs suggested

mediocre security
at best: Stream cipher

with small 48 bit key

Car thefts(source: hldi.org)

Karsten Nohl - Hardware Security

20

Reverse-engineered the secretcipher of the Mifare Classic RFID tag
and evaluated its securityKarsten Nohl - Hardware Security

21Karsten Nohl - Hardware Security

22 Chemically extract chips:
 Acetone

 Fuming nitric acid Shortcut: buy blank chips!
Karsten Nohl - Hardware Security

23

Karsten Nohl - Hardware Security

24Karsten Nohl - Hardware Security

25 Automated polishingwith machine–or– Manually with sand paper “On your kitchen table”-Starbug Potential problem: tilt
 Solution: imbed chip inblock of plastic
Karsten Nohl - Hardware Security26 Simple optical microscope 500x magnification
 Camera 1 Mpixel Costs < $1000, found in most labs
 Stitching images
 Panorama software (hugin) Each image ~100x100 μm

 Align image layers
Karsten Nohl - Hardware Security

27

Cover layer
3 Interconnection layer

Transistorlayer

Logiclayer
Karsten Nohl - Hardware Security28

4 NAND: Y = !(A & B & C & D)

Karsten Nohl - Hardware Security

29

select Logic cells are picked

form a library Library contains fewer

than 70 gate types
 Detection automated(template matchingusing MATLAB)

Karsten Nohl - Hardware Security

detect30Karsten Nohl - Hardware Security

31

++Y

Karsten Nohl - Hardware Security-A
32

YA B
Karsten Nohl - Hardware Security

33

www.siliconzoo.org
 Collection of logic cells
 Free for studying,comparing, and reverseengineering silicon chips
 Zoo wants to grow—send
your chip images!
Karsten Nohl - Hardware Security34 Connections across all layers

 Traced 1500 (!) connections manually Tedious, time consuming Error-prone (but errors easily spottable)
 Tracing completely automated by now
Karsten Nohl - Hardware Security

35Karsten Nohl - Hardware Security

36

Metal wire
Intra-layer via

Karsten Nohl - Hardware Security37

Karsten Nohl - Hardware Security38 Obfuscated placing and wiring of logic cells
 May defeat human inspection, but not automated tools

 Dummy cells

Source: flylogic.net

 Makes reversing harder, but not impossible

 Large chips
 Huge effort, huge rewards?

 Self-destructive chips?
 May protect secret keys, not secret algorithms
Karsten Nohl - Hardware Security

39Challenge

Response

RNG+Key streamf(∙)++

48-bit LFSRID

Mutual authentication
protocolKarsten Nohl - Hardware Security

48-bit stream cipher
40

Karsten Nohl - Hardware Security

41

NXPReader ICµ-Controller

Karsten Nohl - Hardware Securitya) Sniffing datab) Full control over timing!

42

 16(!!)-bit random numbers

RNG

 LFSR –based Value determined by time of read

Our Attack: Control timing (OpenPCD)= control random number (works for tag and reader!)= break Mifare security :)Karsten Nohl - Hardware Security

43 Cipher complexity low
 Was probably a

primary design goal Very efficient
FPGA implementation
Source: Pico Comp.

FPGA cluster finds key
in 50 minutes!
30 sec. when trading space for time!!
Karsten Nohl - Hardware Security

44

fc(∙)

fa(∙)

fb(∙)

fa(∙)

fa(∙)

fb(∙)

48-bit LFSR

 Filter function is a network of smaller

functions that are statistically biased
 Adversary controls inputs, can probe forinternal state bits
 Attack takes < 1 minute on laptop
Karsten Nohl - Hardware Security45 Unpublished attacks that exploit simple

feedback structure and statistical weaknesses Completely passive
 Works for strong random numbers
 Hence, even against Crypto-1 on Mifare Plus!

 Attack takes 6 seconds on laptop
 Stay tuned for publication …

Karsten Nohl - Hardware Security

46

Time Memory Trade Offs
Key Probing

Algebraic Attacks

Weak Authentication Protocol
Weak Filter Function

48-Bit Stream Cipher
Brute Force(due to small key)

Karsten Nohl - Hardware Security

Weak Random
Number
Generator
Replay Attacks(due to predictablerandom numbers)
47

Runtime on
FPGA Cluster($100,000)

Runtimeon PC

Works despite strong
random numbers(Mifare Plus)

Replay Attacks(0)(0)

NoNo

Brute Force

50 min

—

Yes

Yes

Time Memory
Trade Offs (TMTO)

30 sec—NoMaybeKey Probing—

1 min

NoNo

Algebraic Attacks

—

6 sec

Yes

Yes

Karsten Nohl - Hardware Security

Hard toDetect48

Proprietary
Cryptography(i.e., Mifare)
Security
No Crypto
 Protection insufficient for almost all common

uses of smart cards:
 Access control, car theft protection, payment tokens,

TV subscriptions, hardware dongles, …
Karsten Nohl - Hardware Security49

 Reverse-Engineering is possible (and fun) You should try! (we will help)
 Easy targets: small chips with proprietary crypto
 Bigger rewards: bugs, backdoors, debug functions

 Obscurity adds security only in the short-run
 Lack of peer-review hurts later Countermeasures mostly ineffective
Karsten Nohl - Hardware Security

50

Protocols
Cryptography

Secret keys
 More ubiquitous systems typically have more

copies of the secret keys in accessible places Will become weakest link in mobile applications
Karsten Nohl - Hardware Security

52

Protocols

 Secret keys can be stored:

Cryptography
Secret keys

 Online:▪ Keys only stored on central server▪ Expensive setup, long response times

 Semi-online:▪ Devices receive keys at boot time
▪ Keys often stored in DRAM at runtime; bad idea!
 Offline:▪ Devices “securely” store key copy

Karsten Nohl - Hardware Security

53

Chip ID
Everything needed
to disclose key isfound on chip

Encrypted
key

Secret algorithms
can be found; might
be costly (>$100,000)
Karsten Nohl - Hardware Security

Proprietary
Decryption
Chip key oraccess password54 Secret keys should be Different for every user▪ Requires many different keys

 Immediately accessible▪ Requires small number of keys

 Best practice: derive user keys from masterkey; store master key in „key vault“

Karsten Nohl - Hardware Security55 Hardware Security Modules (HSM) Used in ATMs (cash machine) andsome smart card readers Use proprietary encryption
 Hence, can be broken▪ Probably high effort

 Secure Access Modules (SAM)

are much easier to break Credit card / smart card readers
Karsten Nohl - Hardware Security

56

HSM ID

EncryptedkeyHardware Security
Module (HSM)

Proprietary
Decryption
Master key

Card ID,sector, …

AES / 3DES
Card key
Karsten Nohl - Hardware Security57

 „Secure“ Access

Modules are usually
standard microprocessors
 Low effort to extract

master keys
 SIMs/SAMs are
becoming cheaperand less secure!
 (cell phones are not
any better)
Karsten Nohl - Hardware Security

Source: Flylogic
58 Secret algorithms for key storage anddiversification can be found Same techniques that find proprietary encryption
 Easy for most SAMs, high effort for HSMs

 Secret keys can be extracted from “secure”

key storage
 Online systems secure keys, but may necessitate

their own access control Best practice: always be prepared for key roll-over
Karsten Nohl - Hardware Security

59 For the hands-on exercises after the demo,

please download and install: Or, if you already have Matlab and Image

Processing Library installed, get:Karsten Nohl - Hardware Security61 Hardware security is hard Cost constraints, legacy support▪ Leads to weak ciphers

Protocols
Cryptography
Secret keys

 Hardness of distributed trust▪ Online systems too slow and expensive▪ Offline systems may not protect secret key

 Prepare for failure Layer security measures Support key roll-over Never rely on single manufacturer
Karsten Nohl - Hardware Security

63