Design and data security Basic information: Side-channel attacks on ICs

Product piracy and attacks on critical infrastructures are just two examples of the use of side-channel attacks. In doing so, attackers carry out their attacks with surprisingly little effort.

Marco Smutek is a Senior Technology Field Application Engineer at Arrow Electronics

Design and data security is gaining importance in the industry. However, the essence of countless conversations so far is: "We could do more in that area." The use of the subjunctive mood indicates that probably only a few companies are seriously dealing with the topic.

In principle, attacks on hardware can be divided into different groups, which are distinguished by the attacker's prior knowledge of the target. Black-box, grey-box, and white-box are used here for the following explanations.

In a black-box attack, the attacker initially has no information about what is happening inside the chip. They identify inputs and outputs, observe them, and draw conclusions about the interior – the design or program. Not much more is needed to create a product copy. The flash contents are read out and copied onto identical hardware. Done.

It's a question of effort: all security features can be cracked

If an attacker wants to access the contained algorithms, more effort is necessary. It is only a matter of time before the design is no longer a secret. The crucial point is how much energy, and therefore money, the attacker is willing to invest. This is now a matter of discretion. Different standards apply to toys than to sluice gate controls of dams or government communication facilities.

In the case of a Grey-Box attack, the attacker has the same knowledge as in the Black-Box scenario, but additionally 'sees' input (thus output from the perspective of the IC) from parasitic information. These originate from technical implementations of the desired functions and any security mechanisms. Why are passwords not displayed when entering them into login masks? Clearly, someone could be hiding outside the window attempting to capture the characteristic signal of the emitted screen display with an antenna, thus identifying the password.

The master key of encryptions is of particular interest to attackers

The same principle can also be applied to ICs. Typical mechanisms include the analysis of power consumption, electromagnetic emissions, photon emission, or simply the time required to complete a given task. Regardless of the method used, the attacker gains additional information about the design and can increasingly draw precise conclusions using statistics.

Of particular interest is the master key of any encryptions, which should be applied as a minimum protection. Once this is known, the rest is just a matter of course. In a White-Box attack, the attacker has full knowledge of the internals and the implementation of the security function(s). The attack is intentional and a necessary step in the design phase. Just as firmware developers simulate their software to ensure correct functionality under all circumstances, a development team or an external service provider attempts to provide the developing team with information on potential vulnerabilities through test attacks.

Quantum computers could decrypt currently secure cryptographic methods in the future

Cryptography is an efficient method for protecting designs and data from unauthorized access or manipulation. The underlying mathematical procedures are secure according to the current state of technology. However, this continues to evolve. New standards are necessary to meet future security requirements, even with increasingly powerful computers that can be used for attacks. One point of concern is quantum computing: encryptions that are considered secure today (since cracking them would require many years of computing time) may soon become little more than a minor obstacle.

Since commercial products are intended to achieve a certain lifespan in the market, a security solution must incorporate these trends into the architecture and its implementation. This means it is not enough for the solution to meet the current standard. It must also be sufficient for the duration of the distribution and operation of the product. One approach is to enable product updates. The advantage is clear: The product can be adapted over time and any vulnerabilities can be fixed.

However, this also gives an attacker an additional opportunity for an attack. They only need to implement their own update instead of the intended one. Therefore, it is absolutely necessary to ensure that only permitted, authenticated updates can be implemented. With more powerful computers, older cryptographic algorithms are easier to 'crack'. Thus, in addition to updating the algorithms, the use of longer keys is usually required.

Problem: Security consumes computing power

The cryptographic methods must also be implemented as efficiently as possible so that a sufficient portion of the limited computing power remains available for the actual application. This brings us to an important point: The technical implementation of the algorithms. In hardware, this is realized at the transistor level. These switching elements are charged and discharged, which requires energy. This takes time and leads to the emission of electromagnetic radiation or photons. Attackers can record these effects and statistically analyze them. These are classic side-channel attacks. It is important: It is not the algorithm that leads to these information leaks, but the specific implementation in the computing unit.

Execution times of queries for true or false inputs are a possible attack method. The idea is to trigger the cryptographic function in the 'protected circuit'. Example: Access authorization to a residential building. In the simplest case, a fixed target value as an access code is stored in the controller at the entrance door of the apartment block. After each input of one of the characters via the keypad, an immediate query is made as to whether the input matches the target value. If so, the next input is evaluated. If the wrong key was pressed, the process is aborted.

The two paths of the query will usually require a different amount of time to be processed in the controller. This can be measured, for example, through the profile of power consumption. It is quite simple for developers to manipulate this evaluation time so that it is the same in all cases or that only a complete input is evaluated in general. At this point, the developer has already considered a secure implementation. They have taken a step further than just implementing pure functionality.

Determine the power consumption of circuits

The absolute or relative power consumption of circuits can be determined in different ways. Current measurement is carried out using shunt resistors. An attacker faces the challenge of correlating the observed current or power profile (after multiplication by the voltage) with known actions. Such a known action can be, among others, a triggered crypto function. Again, statistical evaluations help to identify the exact timing of the encryption and, sooner or later, the key. The emitted electromagnetic radiation can be recorded and evaluated using antennas.

The approach is essentially identical to measuring power consumption. A major difference is that power consumption refers to the entire chip, while detecting emissions as a function of the antenna size and shape can be very granular. This can generate an activity map of the chip, essentially a map for the attacker. The relevant areas are then closely monitored and measured in series. In the end, statistical analysis is conducted again.

During the operation of ICs, photons are also released. Using measuring devices, these can be counted to generate an activity map. The subsequent steps are identical to those of the other methods.

500 US dollars to crack an AES key

All side-channel attack methods have their strengths and weaknesses. Primarily, they differ in their costs. Thus, the question of the effort required by the attacker arises when choosing the means. To give an idea: for a demonstration to determine the AES key of an unprotected microcontroller, equipment worth about 500 US dollars was used: an antenna for about 20 US dollars and a simple oscilloscope.

The standard PC used for calculations is not included in the cost. Antennas for more sophisticated attacks range in the three or four-digit area. Similar principles apply to oscilloscopes as well. There are hardly any upper price limits. The data volumes range from a few MB to several TB. The necessary software is even partially available as open-source code.

Actively manipulate circuits to provoke reactions

In addition to 'eavesdropping', attackers have the option to actively manipulate circuits in order to provoke desired reactions. For example, local temperature changes can lead to runtime-related errors in the crypto algorithm and be used for the analysis of the key. Power glitches, brownouts, or clock glitches can bring ICs into unstable and undefined states. The same can be achieved with electromagnetic radiation and laser light.

Essentially, the same physical methods that have been used for measurement so far are now used for active influence, a disruption of the ICs, in order to gain new insights. Many analysis methods for extracting crypto keys have the word 'Power' in their name: Simple Power Analysis (SPA), Differential Power Analysis (DPA), Correlation Power Analysis (CPA), Mutual Information Analysis (MIA), Linear Regression Analysis (LRA), Template Attacks. However, the 'Power' methods can be applied not only for power analysis but also for other physical quantities.

In the tension between effort and benefit

It's clear: Absolute security cannot and will not exist. Therefore, it's futile to protect a circuit or application against all types of attacks. The objective regarding security and the attack scenario to be prevented must be clearly and realistically defined from the outset of the design cycle to implement it efficiently.

The biggest obstacle to the widespread effective use of security mechanisms is likely the fact that the resulting additional efforts in terms of development time and the associated product costs usually do not provide the end customer with immediate added value in terms of features. The added value seems to lie more on the side of the manufacturer. Combined with fast time-to-market and a margin necessary for the company's continued existence, design and data security often suffers. It is partially optimized away or poorly implemented. (me)