CrypTech
Building a More Assured
HSM and Obsessing
About the Tool-Chain
Randy Bush <randy@psg.com>

Hardware Security Module
From Wikipedia:
A hardware security module (HSM) is a physicalcomputing device that safeguards and manages
digital keys for strong authentication andprovides crypto processing. These modules
traditionally come in the form of a plug-in cardor an external device that attaches directly toa computer or network server.
141002 CrypTech @ IIJ

Creative Commons: Attribution & Share Alike2

HSMs Are Used For• Principally, Lock-box for Private Keys for••••••••

DNSsecRPKI
PGP
Corporate Authentication
Encryption / Decryption
VPNs
Source of RandomnessYour use goes here

141002 CrypTech @ IIJ

Creative Commons: Attribution & Share Alike3

The Need• Every week a new horror about Crypto/Privacy• der Spiegel’s revelation of the “SpyMall
Catalogue”• Compromises of and trojans in most network
devices, servers, firewalls, ...
• We are relying on HSMs designed and madeby 42-eyes government contractors• Many people are not comfortable with this141002 CrypTech @ IIJ

Creative Commons: Attribution & Share Alike4

141002 CrypTech @ IIJ

Creative Commons: Attribution & Share Alike

5

Origins• This effort was started at the suggestion ofRuss Housley, Jari Arkko, and Stephen Farrellof the IETF, to meet the assurance needs ofsupporting IETF protocols in an open andtransparent manner.
• But this is NOT an IETF, ISOC, ... project,
though both contribute. As the saying goes,“We work for the Internet.”
141002 CrypTech @ IIJ

Creative Commons: Attribution & Share Alike

6

Goals• An open-source reference design forHSMs• Scalable, first cut in an FPGA and CPU,
later allow higher speed options• Composable, e.g. “Give me a key store
and signer suitable for DNSsec”• Reasonable assurance by being open,
diverse design team, and an increasingly
assured tool-chain
141002 CrypTech @ IIJ

Creative Commons: Attribution & Share Alike

7

Open and Transparent• The project is being run in a maximallyopen, transparent manner withtraceability for all decisions etc.
• We do this in order to build trust in
the project itself• And diverse, engineering and funding
141002 CrypTech @ IIJ

Creative Commons: Attribution & Share Alike8Funding (so far) From
A Few PrivateDonations

141002 CrypTech @ IIJ

Creative Commons: Attribution & Share Alike

9Layer Cake ModelApplications

DNSSEC, RPKI, PGP, VPN, OTR, random, TCP/AO, …

Off-ChipSupport CodeX.509/PGP/… Packaging, PKCS#7/10/11/15, Backup

On-Chip Core(s)KeyGen/Store, Hash, Sign, Verify, Encrypt, Decrypt, DH, ECDH,
PKCS#1/5/8, [Un]Load, Stretching, Device Activation/Wipe

FPGA (ASIC)

Hashes: SHA*/MD5/GOST Encrypt: AES/Camellia PublicKey RSA/ECC/DSA, Block Crypto Modes
TRNG, BigNum, Modular, Exponentiation

141002 CrypTech @ IIJ

Creative Commons: Attribution & Share Alike

Security
Boundary&Tamper
PowerTiming

10

FPGA Cat Video

141002 CrypTech @ IIJ

Creative Commons: Attribution & Share Alike

11

A Prototyping Board

141002 CrypTech @ IIJ

Creative Commons: Attribution & Share Alike

12

Novena Spartan ‘Laptop’
FPGA

141002 CrypTech @ IIJ

Creative Commons: Attribution & Share Alike

13

Entropy with Pi Pin-Out

141002 CrypTech @ IIJ

Creative Commons: Attribution & Share Alike

14

Entropy on Novena

FPGA

141002 CrypTech @ IIJ

Creative Commons: Attribution & Share Alike

15

Entropy Porn

141002 CrypTech @ IIJ

Creative Commons: Attribution & Share Alike

16

TRNG Chain

141002 CrypTech @ IIJ

Creative Commons: Attribution & Share Alike

17

The TRNG Architecture
P

Entropy
ProviderMixer(SHA-512)Seed

CSPRNG(ChaCha)RandomvaluesEntropy
ProviderP
External
Noise
SourceControl & Test

FPGA141002 CrypTech @ IIJ

Creative Commons: Attribution & Share Alike18

Or Maybe
P

Entropy
ProviderMixer(SHA-512)Seed

CSPRNG(ChaCha)RandomvaluesEntropy
ProviderP
External
Noise
SourceControl & Test

FPGA141002 CrypTech @ IIJ

Creative Commons: Attribution & Share Alike

19

Test and Observability•Two modes•

Production Mode (PM) and Test Mode (TM)

•Observability of entropy sources in PM•

Continuous on-line testing in PM•

Injection in stages and complete chain in TM•

Generation of a small number of values in TM••

Allows test of all digital functionality including
continuous tests.
Full restart when going between TM and PM

141002 CrypTech @ IIJ

Creative Commons: Attribution & Share Alike

20

Observability & Test of Entropy Sources
PEntropy
collect

Postproc

Entropy tomixer

AIS31

On-line tests
alarmb0rk

Noisealarm

Test access to noise and entropy• Extract for off-line comprehensive testing• Inject for functional testing in test mode

141002 CrypTech @ IIJ

Creative Commons: Attribution & Share Alike

21

Observability & Test of Mixer
EntropyMixfunctionSeed(SHA-512)
Entropy

Inject for functional testing in test mode

141002 CrypTech @ IIJ

Creative Commons: Attribution & Share Alike

22

Observability & Test of CSPRNG

SeedStream cipher

Randomvalues(ChaCha)

Inject for functional testing in test mode

141002 CrypTech @ IIJ

Creative Commons: Attribution & Share Alike23

Some of the Fears• ToolChain Poisoning• Device Poisoning• Side-Channel Attacks• How can you tell if your vendor actually
implemented CrypTech, and correctly?
141002 CrypTech @ IIJ

Creative Commons: Attribution & Share Alike

24

The Tool Chain• When my laptop’s fan goes on, I think itis the NSA, GCHQ, Israelis, Chinese, …
are fighting to see who will own me• We have NO ASSURANCE of our toolset, from CPU to Kernel to Compiler to …
• When constructing assurance-criticaltools, we need to maximize assurance inthe tools used to build them
141002 CrypTech @ IIJ

Creative Commons: Attribution & Share Alike

25

The Compiler• Ken Thompson’s 1984 Turing Award paper
Reflections on Trusting Trust• A self-reproducing trap in the C compiler
which “would match code in the UNIX
"login" command. The replacement code
would miscompile the login command sothat it would accept either the intended
encrypted password or a particular known
password.” You have been owned!
141002 CrypTech @ IIJ

Creative Commons: Attribution & Share Alike26

Double-Diverse Compilation• In his 2009 PhD dissertation, DavidWheeler explained how to counter the“trusting trust” attack by using the“Diverse Double-Compiling” (DDC)
technique• We can use this on GCC and clang to getsomewhat assured compilers• But you still have to inspect the source!
141002 CrypTech @ IIJ

Creative Commons: Attribution & Share Alike

27

Critical Tool-Chain• C compilers audited and built using DCC• Audited kernel, libc, …
• Audited whole darn UNIX or Linux• Audited Verilog compiler• Audited FPGA download tools• Audited test tools• Trojan prevention & detection
141002 CrypTech @ IIJ

Creative Commons: Attribution & Share Alike28

HDL / Verilog• But FPGAs/ASICs are programmed in a
Hardware Definition Language, Verilog• It is very hard to get an open Verilog
compiler• Verilog can not compile itself, so DDC isnot applicable here, just a DCC C compiler• We are working on methods of gaining
trust in the FPGA tool chain
141002 CrypTech @ IIJ

Creative Commons: Attribution & Share Alike29

Side Channel & Tampering• Exponentiation circuit timing leaks areexploitable remotely• Power leakage is exploitable locally• Physical attack detection critical• Wipe key store if tampering detected• Side-Channel attacks are the subject ofentire conferences
141002 CrypTech @ IIJ

Creative Commons: Attribution & Share Alike

30

Potting Boundary• The FPGA/ASIC and accompanying Core(s) (ARM, whatever) are within
the physically protected boundary of the chip carrier potting.
• On-board battery/capacitor to buy the time to wipe all data if unplugged
from power• We worry about tampering, what if the chip is opened and attacked? Sothe potting includes tampering sensors and code to wipe all keys iftampering is detected.

On-Chip Core(s)KeyGen/Store, Hash, Sign, Verify, Encrypt, Decrypt, DH, ECDH,
PKCS#1/5/8, [Un]Load, Stretching, Device Activation/Wipe

FPGA

Hashes: SHA*/MD5/GOST Encrypt: AES/Camellia PublicKey RSA/ECC/DSA, Block Crypto Modes
TRNG, BigNum, Modular, Exponentiation

141002 CrypTech @ IIJ

Creative Commons: Attribution & Share Alike

Security
Boundary&TamperPowerTiming31

Some Phases• First Year: Tool-chain, Basic Design, notall cyphers, not all protocols, prototype
implementations on FPGAs and boards• Second Year: Better Tool-chain, allneeded cyphers, hashes, crypting, … andintegration with some apps, DNSsec,RPKI, TLS, PGP, Tor• Third Year: Solid packaging, ability tocompose designs for use cases, etc.
141002 CrypTech @ IIJ

Creative Commons: Attribution & Share Alike

32

A Few Related Projects• Truecrypt audit: http://
istruecryptauditedyet.com!
• OpenCores: http://opencores.org!
• Icarus Verilog: http://iverilog.icarus.com!
• Valgrind: http://valgrind.org!
• clang+llvm: http://clang.llvm.org!
141002 CrypTech @ IIJ

Creative Commons: Attribution & Share Alike33

141002 CrypTech @ IIJ

Creative Commons: Attribution & Share Alike34

https://cryptech.is/141002 CrypTech @ IIJ

Creative Commons: Attribution & Share Alike

35