AES Wireless Keyboard- Template Attack for Eavesdropping Kwonyoup Kim, Tae Hyun Kim, Taewon Kim, Sangryeol Ryu
SNT Works Inc., Rep. of Korea
http://www.sntworks.kr
March 22th, 2018

About us▪

Kwonyoup Kim, Founder, CEO of SNT Works Inc.

▪

Tae Hyun Kim, PhD., CTO of SNT Works Inc.

▪

SNT Works• Specialized in Security Analysis on Embedded Systems✓ Reverse Engineering for Security Evaluation, Assessment✓ Side Channel Attack & Fault Attack✓ Patent infringement Investigation

2

Previous Related Works of Wireless Keyboard & Mouse▪ KeyKeriki v1.0 and v2.0 by Dreamlab Technologies, 2010
▪ Promiscuity is the nRF24L01+’s Duty, Travis Goodspeed, 2011
▪ KeySweeper, Samy Kamkar, 2015

▪ MouseJack, Bastille Networks Internet Security, 2016
▪ Deeg & Klostermeier, Of Mice and Keyboards : On the Security of Modern WirelessDesktop Sets, Hacktivity 2016

3

Motivations▪ Deeg & Klostermeier’s Results, Hacktivity 2016
• Found Security Vulnerabilities
1. Insufficient protection of code (firmware) and data (cryptographic key)
2. Unencrypted and unauthenticated data communication
3. Missing protection against replay attacks
4. Insufficient protection against replay attacks

5. Cryptographic issues• Manufacturer Feedback

4Our Goals▪ Eavesdropping of AES Wireless Keyboard without physical access• Reverse Engineering of AES Wireless Keyboard✓ Construction of SCA(Side Channel Attacks) environment• Side Channel Attacks of AES Wireless Keyboard✓ EM Side Channel Attacks

Attack✓ Recover secret 128 bits AES keys
128bit AES KEY• Building templates using the recovered key• Attacking the other keyboard with different unknown key

5

AES Wireless Keyboard- Reverse Engineering -Reverse Engineering of AES Wireless Keyboard▪ Firmware & NVRAM Acquisition• Keyboard (nRF24LE1)▪ Static Analysis• Disassembling firmware (IDA Pro)
• Finding Encryption functions▪ Dynamic Analysis• Debugging Codes (nRFgo Studio)• Verifying Encryption functions (IV, Salt, Key, Enc-Mode, …)▪ Firmware Modification• Modifying Codes for Repeated execution• Reprogramming of Keyboard firmware

7

Reverse Engineering of AES Wireless Keyboard▪ Firmware Acquisition – Keyboard

8Reverse Engineering of AES Wireless Keyboard▪ Firmware Acquisition – nRF24LE1• Flash memory : features▪ 16 kB code memory▪ 1k NV data memory▪ Page size 512 bytes for NV data memory and program memory▪ Two pages of 256 bytes each for extended endurance memory▪ 32 pages of main block + 1 InfoPage▪ Endurance minimum 1000 write/erase cycles▪ Extended endurance memory, minimum 20000 write/erase cycles▪ Direct SPI programmable▪ Configurable MCU write protection▪ Readback protection▪ HW support for FW upgrades

9Reverse Engineering of AES Wireless Keyboard▪ Firmware Acquisition – Pinout

NAFCSNRESETFSCKGND

VCC

PROG

FMOSI

FMISONA10

Reverse Engineering of AES Wireless Keyboard▪ Firmware Acquisition – nRF24LE1• Flash memory Dump

$ ./nrfprog /dev/ttyUSB0 dump.bin
Opening the Bus Pirate UART
Setting the Bus Pirate to Binary Mode
Configuring SPI mode
Backing up the info page
Starting read operation
Reading from the device to dump.bin
Starting read operation

Putting the Bus Pirate back in normal operating mode
Closing the Bus Pirate$ ls -alh dump.bin info_page.dat-rwxrwxrwx 1 root root

16K April 28 19:32 dump.bin-rwxrwxrwx 1 root root

256 April 28 19:32 info_page.dat
11

Reverse Engineering of AES Wireless Keyboard▪ Static Analysis – Disassembling12

Reverse Engineering of AES Wireless Keyboard▪ Static Analysis – Finding Encryption functions

nRFgo SDK source : hal_aes.c

13

Reverse Engineering of AES Wireless Keyboard▪ Static Analysis – Finding AES key• Flash Dump from another keyboard

14

Reverse Engineering of AES Wireless Keyboard▪ Static Analysis – Finding AES key• NVRAM are not the same values• Whether or not the AES key is validated using debugging

15

Reverse Engineering of AES Wireless Keyboard▪ Dynamic Analysis – Debugging codes

nRFgo Start Kit & nRF24LE1

16

Reverse Engineering of AES Wireless Keyboard▪ Dynamic Analysis – Verifying Encryption functions
Plain PacketXORSession KEYAES128

Product KEY

Send Out Wirelessly

17Reverse Engineering of AES Wireless Keyboard▪ Firmware Modification – Modifying codes for Repeated execution• Initial input of all zero bytes• Output  Next Encryption input• Inserting artificial trigger signal before each encryption• 100 ms delay▪ Firmware Modification – Reprogramming of Keyboard firmware• Write protection is set for the target keyboard• So, We changed it to a reprogrammed chip for Side channel analysis

18

AES Wireless Keyboard- Side Channel Attacks, Template Attacks -Side Channel Attacks of AES Wireless Keyboard▪ Side Channel Attacks in Theory

commandWhite-box Attack Model

response

Targetiteration- Manipulating key

PC- Target control store- Oscilloscope
signals
controlpower
EMTriggering▪ All information known andcontrollable- Known Specification- Known Interfaces- Known Design (by oneself)- Known Implementation details

Oscilloscope- SignalAcquisition- Ideal Setup20

Side Channel Attacks of AES Wireless Keyboard▪ Side Channel Attacks in Real World

commandBlack-box Attack Model

response

Targetiteration- Manipulating key

PC- Target control store- Oscilloscope
signals
controlpowerEMTriggering▪ Most information unknown andcontrollable- Known Specification Only
- Unknown Interfaces- Unknown SW/HW Design- Unknown Implementation details

Oscilloscope- Signal
Acquisition- Many unknown factors for setup

21

Side Channel Attacks of AES Wireless Keyboard▪ Side Channel Attack Environment⑤④Setup①③②①

Target Keyboard with AES key② Langer LF-1 near-field probe set③Langer PA303 pre-amplifier④

Digital Oscilloscope⑤ Software to control a target and anoscilloscope

22

Side Channel Attacks of AES Wireless Keyboard▪ Side Channel AttackAttack Process

commanditerationKeyboard

EM signal

PC

store signals▪

Acquisition▪

Alignment▪

Correlation with input/output▪

Profiling AES algorithm

▪

CPA

▪

Building templates▪

Template attack

Oscilloscope

23

Side Channel Attacks of AES Wireless Keyboard▪ CPA (Correlation Power Analysis)• Pearson Correlation Coefficient• T : measurement, P : predictions• Number between -1 and 1-1 : total negative linear correlation

𝝆 𝑻, 𝑷 =𝑬 𝑻𝑷 − 𝑬 𝑻 𝑬(𝑷)𝑽𝒂𝒓 𝑻 𝑽𝒂𝒓(𝑷)0 : no linear correlation

1 : total positive correlation

24

Side Channel Attacks of AES Wireless Keyboard▪ CPA (Correlation Power Analysis) with input• Confirm plaintext loading operation• HW model• 1K traces• 1M samples

Correlation coefficient result

Loading input

1R

2RCorrelation coefficient result for plaintext 16-byte
25

Side Channel Attacks of AES Wireless Keyboard▪ AES (Advanced Encryption Standard)

26

Side Channel Attacks of AES Wireless Keyboard▪ Profiling EM Trace

VoltageAES - 128
Input

1R

2R

3R

4R

5R

6R

7R

8R

9R 10R

OutputTime (# of samples)•Round Functions

Loading Input

AddRoundKey

ShiftRow

MixColumns& S-BoxInput※ Hardware Co-processor of MixColumns operation27

Side Channel Attacks of AES Wireless Keyboard▪ CPA (Correlation Power Analysis)• Recover the secret key• Target variable : S-Box output
1 5 9132

14 3 76 10151181612 4

Order of Sbox

• HW model• 1K traces• 1M samples

1R
ShiftRow & S-box

MixColumns

CPA result for 8-bit outputs of Sbox in the first round28

Side Channel Attacks of AES Wireless Keyboard▪ Basic Template Attacks

29

Side Channel Attacks of AES Wireless Keyboard▪ Selecting Interesting Points• Computational or memory restrictions• Reducing the number of samples and the size of templates• Selection of some special samples that contain the most information about thecharacterized key-dependent operation✓ DOM (Sum of pairwise Differences)✓ SOSD (Sum of Squared pairwise Differences)✓ SOST (Sum of Squared pairwise T-differences)✓ NICV (Normalized Inter-Class Variance)✓ PCA (Principal Component Analysis)✓ LDA (Linear Discriminant Analysis)✓…
30

Side Channel Attacks of AES Wireless Keyboard▪ Selecting Interesting Points – SOST

Grouping &Averaging

Comparison

SOST

31

Side Channel Attacks of AES Wireless Keyboard▪ Building Templates• 256 templates for a bytes AES key• Training set : 1K traces for each template (total: 256K)• Test set : 1K traces for each value (total: 256K)• Point of Interest : 150 points• Method : SOST, PCA, Pooled Covariance Matrix✓ Case 1: same device (profiling = matching device)✓ Case 2: different device (profiling ≠ matching device)32

Side Channel Attacks of AES Wireless Keyboard▪ Template Attacks : Case 1 – Same device• Selecting POI : SOST

Success Rate (%)• Template Matching : Maximum Likelihood

98.2

99.7

99.3

100

100

100

100

96.2

86.7
POI 40

POI 100

BallSize 1

BallSize 3

POI 150

BallSize 5• Success Rate is the probability that the correct key is ranked among the first n candidates.
• BallSize n means the top n candidates ranked according to score, highest to lowest.

33

Side Channel Attacks of AES Wireless Keyboard▪ Template Attacks : Case 2 – Difference device• Selecting POI : SOST, PCA, Pooled Covariance Matrix✓ Common POI of Device 1 (training) and POI of Device 2 (target)✓ 139 Points in 150 points• Template Matching : Maximum Likelihood

Success Rate (%)

60.1
46.9

46.7

28.5
23.8

22.5

22.2
17.5

17.2
10.2

8.4
SOST9.2
PCA

BallSize 1

SOST+POOLEDBallSize 3

PCA+POOLEDBallSize 534

Side Channel Attacks of AES Wireless Keyboard▪ Template Attacks : Case 2 – Difference device• Characteristics comparison between two devices

Comparison of mean traces

difference of covariance matrices

35

Side Channel Attacks of AES Wireless Keyboard▪ Enhanced Attacks : Case 2 – Difference device• Rebuilding robust templates using both training device and target devices*• Matching with robust templates to device 1, 2 respectively
Device 2Success Rate (%)

Device 1
90.1

95.6

100
75.9

PCA+POOLED

97.7 99.7

92.2

89.8

86.5

81.7

70.5

LDA+POOLEDBallSize 1

PCA+POOLEDBallSize 3

77.3

LDA+POOLEDBallSize 5*O. Choudary and M. G. Kuhn, “Template Attacks on Different Devices”, in COSADE 2014
M. Renauld, F.-X. Standaert, N. Veyrat-Charvillon, D. Kamel, and D. Flandre, “A Formal Study of Power Variability Issues and Side-Channel Attacks for Nanoscale Devices”, in EUROCRYPT 201136

Side Channel Attacks of AES Wireless Keyboard▪ Proposed Attacks : Case 2 – Difference device• Adjusting the difference between means of two devices by correction vector
𝑪𝒐𝒓𝒓𝒆𝒄𝒕𝒊𝒐𝒏 𝒗𝒆𝒄𝒕𝒐𝒓 =𝒎𝒆𝒂𝒏 𝒐𝒇 𝒕𝒂𝒓𝒈𝒆𝒕 𝒕𝒓𝒂𝒄𝒆𝒔
𝒎𝒆𝒂𝒏 𝒐𝒇 𝒕𝒆𝒎𝒑𝒍𝒂𝒕𝒆 𝒕𝒓𝒂𝒄𝒆𝒔• Rebuilding templates using corrected traces on training device

Success Rate (%)• Matching with corrected templates to target device

98.8

99.9

99.5

100

94.2
91.1

PCA

BallSize 1

PCA+POOLEDBallSize 3

BallSize 537

Side Channel Attacks of AES Wireless Keyboard▪ Result• Success rate for case 1, 2(%)

135

The used
number oftarget
trace

100

100

100

1Single

28.5

46.9

60.1

1

Robust

88.3

96.65

99.85

1,000

Corrected

94.2

99.5

100

256

the number of candidatesSame device

Differencedevice※ Our attack requires the number of traces much less than the robust template attack
38

Summary▪ Side-channel attack on secure wireless keyboard▪ Setup for SCA environment using reverse engineering in Real World▪ Performing EM analysis attacks to recover the AES key▪ Template attack on the other keyboard▪ Future research• We need more improved template attack• We need Far-field EM attack (long distance)• We need to apply it to other devices of similar types

39

Blackhat Sound Bytes▪ Side-channel attack is a serious threats in real-world.

▪ Wireless keyboards with AES is not secure.

▪ Manufacturers need to defend against reverse engineering and side-channel attacks.

40

Thanks!
Any Questions?
Contact
Kwonyoup Kim,

CEO/founder, kkyoup@sntworks.kr

Tae Hyun Kim,

CTO, thkim@sntworks.kr

Taewon Kim,

Senior Researcher, ktw@sntworks.kr

Sangryeol Ryu,Researcher, rsr@sntworks.kr