SECRET UNKNOWN CIPHERS VS HARDWARE SENSITIVE MODULES AS ROOT OF TRUST - by Dr Katy Win
Reasoning:
Pegasus Spyware misuse: If Pegasus enters the cloud, what risks does this bear to national and critical infrastructure? Infiltration of Pegasus can lead to deep fake news and data which can be automated by Style GAN leading to double deep fakes. Pegasus infiltration can be intercepted via radio frequency.
Typical Encryption technology allows criminals and terrorists to ‘go dark’.
The NSO group licenses surveillance software to government agencies,, plus NSO
software can locate where a phone is being used; defend against drones and can mine
law enforcements data to spot patterns.
Article by ‘Wired’ 2014 ‘Radio-frequency hack developed by researchers in Israel would let attackers steal data remotely from even air-gapped computers not connected to the internet’. Computers housing the world's most sensitive data are usually "air-gapped" (not connected to internet/bluetooth or connected to other internet connected systems). NSA use radio frequency signals to remotely siphon data from air-gapped machines using transceivers---a combination receiver and transmitter---attached to or embedded in the computer instead of a mobile phone. Passwords/data from an infected computer can be siphoned using radio signals generated and transmitted by the computer’s video card and received by a mobile phone. Malware can generate radio signals that transmit data which the inbuilt FM receiver on mobiles receive then decode. Audio Frequency-Shift Keying (A-FSK) is the most effective for transmitting digital data over audio signals. These EM radio signals using these transceivers act as a covert channel to extract data. The malware stores stolen data on the machine until a USB flash drive/other removable device is inserted, at which point data is copied to the drive. When the flash drive is then inserted into another computer that is connected to the internet, the data gets transmitted back to the attackers' command-and-control centre.
The AWS Amazon Cloud is now being used by US and UK governments to host sensitive secret data.
Spyware vs Cloud: why would terrorists/criminals/offending nations attack a device when they could attack the cloud and have access to every device’s data?
There is a Risk of Side Channel Attacks via Radio Frequency Interception
AWS AMAZON HSM CLOUD
AWS Cloud HSM is an Amazon Web Server hardware security module (HSM) enables easy generation of encryption keys on the AWS cloud.
HSM FIPS 140-2 level 3 (provides tamper evidence [level 2] + tamper resistance [level 3]
which was last updated in 2018 but last validated 7/9/21.
FIPS is the Federal Information Processing Standard and 140-2 is the benchmark for validating the effectiveness of cryptographic hardware.
PROBLEM: FIPS 140-2 level 3 HSM is open to side channel attacks via TEMPEST ATTACKS 'Telecommunications Electronics Material Protected from Emanating Spurious Transmissions’ ie. via leaking electromagnetic emanations.
Therefore the AWS HSM cloud will be open to side channel attacks
GLADMAN CAMBRIDGE DEPARTMENT IN COMPUTER SCIENCE WROTE A BOOK CHAPTER ON PHYSICAL TAMPER DEVICES stating “There is a large gap between level 4 and the next one down, level 3, where only potting is required and attacks that exploit electromagnetic leakage, memory remanence, drilling, sandblasting and so on may still be possible”… “There are no generic countermeasures that resist all classes of side channel attacks”
Threat model = remote vs local access and passive vs active etc.
SIDE CHANNEL ATTACKS CAN BE DONE VIA MONITORING THE EXECUTION TIME/POWER CONSUMPTION OR EM-RADIATION WHERE THE DEVICE IS UNDER NORMAL OPERATION.
Types of side-channel attacks:
- Timing attacks
- Template attack: the attacker creates a copy/template of the target device then
studies the behaviour for all large/small inputs of data and secret values. Then the
sets to the templates are compared in the database to deduce the secret info from
the device.
Could there be a risk of key exhaustion via a TEMPEST side channel attack from
guessing the key too many times leading to lock out of the key?
- Fault attacks
WHY DO I THINK THIS?
Public keys are stored in the blockchain, therefore anyone can verify you as the owner with your public key
Hardware security modules (HSM) are physical boxes that carry out cryptographic operations and never reveal the keys inside. They are designed to have very high security and therefore are used to protect an organisation’s most valuable cryptographic keys… HSMs are stated to be the most widely trusted device to store keys securely.
However the HSM FIPS 140-2 level 3 model being used for AWS cloud HSM was last updated in 2018 and last validated in 7/9/21. HSM has already since then in 2019 shown to be hackable.
LEDGER RESEARCHERS IN FRANCE 2019 SHOWED THAT HSM CAN BE HACKED BY UPLOADING UNSIGNED FIRMWARE OF THEIR LIKING TO REMOTELY EXTRACT ALL KEYS AND SECRETS FROM THE HSM. THE PROBLEM IS THAT HSM CANNOT BE PATCHED IF IT IS ALREADY COMPROMISED BEFORE THE PATCH FOR VULNERABILITIES IS RELEASED. WHAT IS IMPORTANT HERE IS THAT THE MALICIOUS FIRMWARE INSTALLED BY THE ATTACKERS CAN KEEP A BACKDOOR OPEN
>>>> SO THE PROBLEM WITH HSM HARDWARE IS THAT ANY COMPROMISE CANNOT BE PATCHABLE AT ALL.
HSM’S WERE BUILT FOR PHYSICAL PROTECTION AND NOT MEANT FOR THE PURPOSE OF PRIVATE AND PUBLIC CLOUDS.
FIPS 140-2 IS THE PRIMARY CERTIFICATION FOR CRYPTOGRAPHIC MODULES INCLUDING HSMs AND HAS DIFFERENT LEVELS OF SECURITY:
LEVEL 1+2: MET BY SOFTWARE SOLUTIONS ONLY
LEVEL 3+4 NEED PHYSICAL SECURITY
THE ONLY DIFFERENCE BETWEEN LEVEL 2 + 3 IS THE ADDITION OF PHYSICAL SECURITY. EVEN IF THERE IS PHYSICAL SECURITY IN LEVEL 3 + 4 ie. PHYSICAL PROTECTION THIS SAYS NOTHING ABOUT THE SECURITY OF THE SOFTWARE ITSELF.
THE ATTACK BY LEDGER RESEARCHERS ON HSM WAS BASED ON VULNERABILITY IN THE SOFTWARE IE. AT LEVEL 2 SO WHENEVER THE HSM CAN BE PLACED IN AN ENVIRONMENT THAT IS ALREADY SECURE (EG. THE CLOUD/A PROTECTED DATA CENTRE) THE PHYSICAL PROTECTION BY HSMs BECOMES IRRELEVANT.
THIS MEANS THAT IN THE AWS HSM CLOUD, THE DATA LIES VULNERABLE IN THE HSM AT LEVEL 2 FIPS.
THE VULNERABILITY WITH HSM THEN BECOMES A BACKDOOR THAT SURVIVES A FIRMWARE UPDATE.
AMAZON AWS uses Microsemi Secure Production Programming Solution (SPPS) that uses PolarFire FPGAs with the support of HSM.
PolarFire FGPAs are provisioned using FIPS 140-2 level 3 certified hardware security modules. All secret keys are encrypted and authenticated during transit and encrypted while stored, only being generated and used within the secure hardware boundary of an HSM or the FPGA.
MICROSEMI’S Previous ProASIC3 chip which was a military grade FPGA was shown in 2012 by a collaboration of researchers between the University of Cambridge and Quo Vadis Labs London that this had a backdoor. They patented a technique called PIPELINE EMISSION ANALYSIS (PEA) TO DETECT AND ANALYZE A BACKDOOR INSERTED INTO THE ACTEL/MICROSEMI PROASIC3 CHIPS FOR ACCESSING FGPA CONFIGURATION. THE BACKDOOR EXISTS ON THE SILICONE CHIP ITSELF AND HAD A JTAG CONTROLLER AS PART OF ITS SILICONE DESIGN WHICH HAD A HIDDEN FUNCTION OF ALLOWING COVERT ACCESS TO THE CONFIGURATION DATA.
THIS MEANT THAT THEY COULD EXTRACT THE SECRET KEY AND ACTIVATE THE BACKDOOR TO EXTRACT ALL THE CONFIGURATION DATA FROM THE CHIP, REPROGRAM THE CRYPTOGRAPHY AND ACCESS KEYS, MODIFY LOW LEVEL SILICONE FEATURES, AND ACCESS UNINTERRUPTED CONFIGURATION BITSTREAM/PERMANENTLY DAMAGE THE DEVICE.
The risks of this are that the device is wide open to intellectual property (IP) theft, fraud, and re-programming as well as reverse engineering of the design which allows the introduction of a new backdoor or Trojan. Chips cannot have the backdoors patched once deployed, they must be replaced with a redesign of the silicone. The chip (PRO ASIC 3) was built in China. This is not the first time chips have been manufactured in China with a backdoor (sold on Amazon).
RESEARCH FROM HONG KONG 2021 SHOWED THAT AES IS OPEN TO FOR FIELD ELECTROMAGNETIC EMISSION SIDE CHANNEL ATTACKS.
IN 2018 MICRO SEMI WAS BOUGHT BY MICROCHIP AND THEY HAVE RELEASED THE POLARFIRE FPGAs. MICROCHIP STATE THEY CANNOT BE HACKED OR CLONED/TAMPERED WITH, AND THEY CREATE A SEVERE ROOT OF TRUST.
However I detect the following problems:
>> POLARFIRE FPGAs ONLY USE DIFFERENTIAL POWER ANALYSIS (DPA) COUNTERMEASURES AGAINST DPA ATTACKS, AND OFFER DPA RESISTANT AES CRYPTOGRAPHIC CORES THAT OFFER CHIPMAKERS A WAY TO PROTECT AGAINST SIDE CHANNEL ATTACKS. THESE DO NOT PROTECT AGAINST PEA ATTACKS.
THE OFFICIAL PRODUCTION IS NOW BASED IN BEIJING - IS THIS A CONCERN?
ALSO POLARFIRE FPGAs ARE BASED ON SRAM PUF, provisioned using FIPS 140-2 level 3 certified hardware security modules.
Physically Unclonable Functions (PUFs) need high software and hardware overheads. Secret Unknown Ciphers (SUCs) have a lower latency than PUFs. SRAM-SUC have a lower latency of generating a response to a challenge more than 40,000 times compared to Quiddikey IP in smart fusion 2 Soc FGPAs that are used in the SRAM-PUF by Microsemi technology gained from collaboration with Intrinsic ID.
Strong PUFs can be cloned via modelling attacks. Weak PUFs are open to hybrid attacks via side channels and machine learning.
PUFs are compromised over its lifetime by reliability, in terms of ambient variations such as power, temperature, noise, interference and a degree of mismatch.
Therefore, the use of SRAM for a PUF results in instability of the memory’s initial state. These inherent drawbacks of SRAM make it a poor PUF solution.
SRAM PUF IS COSTLY AND HAS A LONGER LATENCY IE. IT TAKES TIME TO PROTECT AND EXTRACT DATA. SUCs have a randomly internally generated cipher/hash inside the chip where no user has access or influence on how it creates a cipher.
It cannot be reverse engineered/hacked/cloned. SUCs are digital clone resistant structures. They can be implemented with zero cost. With SUCs we can make use of the free FPGA resources and can be incrementally added to customer design with zero cost. In SUC, secrets are distributed and not in one location so makes it harder to break the SUC key.
I PROPOSE THAT SUC ACTS AS THE ULTIMATE ROOT OF TRUST AND THAT WE SHOULD MOVE TO A MODEL OF SRAM-SUC.
RANDOM INTERNALLY GENERATED CIPHERS/HASH INSIDE THE CHIP WHERE THE USER DOES NOT HAVE ACCESS OR CANNOT INFLUENCE HOW THE KEY IS GENERATED BECAUSE IT CANNOT BE REVERSE ENGINEERED/HACKED OR CLONED.
SUC IS A DIGITAL CLONE RESISTANT STRUCTURE. WE NEED TO DEVELOP TRUE vs. PSEUDO RANDOM NUMBER GENERATION AND ASYMMETRIC KEY GENERATION.
BECAUSE THERE ARE ASYMMETRIC CIPHERS IN SUC, THE PUBLIC KEY/CIPHER GETS STORED IN THE SUC CLOUD AS A SUC CHAIN (SUC BLOCKCHAIN), SUC CANNOT BE SIDE CHANNEL ATTACKED BY TEMPEST. THIS IS WHY SUC HAS THE ADVANTAGE OVER HSM.
INVESTIGATE WHETHER: IF THE HSM HAS A SUC AS A ROOT OF TRUST THEN CAN THIS PROTECT AGAINST TEMPEST SIDE CHANNEL ATTACKS?
Solution
Blockchain has a 64 bit commander channel that can be decrypted/intercepted because it uses symmetrical encryption where 1 public key stays on the cloud and 1 private key stays with you.
The amazon AES cloud server uses 256 bit encryption which is the limit of encryption for symmetrical keys. Anything above this bit encryption is asymmetrical key encryption encompassing an SUC (secret unknown cipher) on a System chip on the hard drive that cannot be cloned/hacked/intercepted nor can data be intercepted via RF.
Cryptocurrency can be intercepted on the blockchain because the public key on the cloud can be hacked. With either Lacie Hardware Model, 1 key should ideally stay on the System chip SUC and 1 key with the owner - ie. there should be 2 private keys. To integrate organisations one could use an internal cloud/blockchain (SUC cloud/SUC blockchain) for the public keys to be on the private cloud/blockchain and the private keys to remain with individuals within an organisation. One could randomise the public and private keys for ultra encryption via random number generation and record this on a blockchain within the private cloud so records of access to data can be recorded and tracked.
SRAM (Static Random Access Memory) refers to a RAM hard drive which needs an external power supply but if this power supply runs out, all the data will be lost. The Lacie Starck Bladerunner LAC9000119 utilises a SRAM hard drive. Therefore it is best to use a Lacie Exchange Starck USB 3.0/2.0 mobile device which uses a DRAM hard drive and does not need an external power supply.
For existing hardware devices, one can download ‘GENIE’ Software which will incorporate a systemic SUC onto the existing chip in the hardware. This will the same operate as an SUC but will be a version of a Digital PUF.
REFERENCES
Mars, Ayoub & Ghandour, Hussam & Adi, Wael. (2021). SRAM-SUC: Ultra-Low Latency Robust Digital PUF. https://www.researchgate.net/publication/352397389_SRAM-SUC_Ultra-Low_Latency_Robust_Digital_PUF/citation/download
Ingrid Verbauwhede KU Leuven COSIC. Cyber Security Body of Knowledge: Hardware Security
Chegeni, Vahid & Haj Seyyed Javadi, Hamid & Goudarzi, M. & Rezakhani, Afshin. (2021). Providing a hybrid cryptography algorithm for lightweight authentication protocol in RFID with urban traffic usage case.
Mars and W. Adi, "Fair Exchange and Anonymous E-Commerce by Deploying Clone-Resistant Tokens," 2019 42nd International Convention on Information and Communication Technology, Electronics and Microelectronics (MIPRO), 2019, pp. 1226-1231, doi: 10.23919/MIPRO.2019.8756734 https://ieeexplore.ieee.org/document/8756734
Skorobogatov, S., Woods, C. (2012). Breakthrough Silicon Scanning Discovers Backdoor in Military Chip. In: Prouff, E., Schaumont, P. (eds) Cryptographic Hardware and Embedded Systems – CHES 2012. CHES 2012. Lecture Notes in Computer Science, vol 7428. Springer, Berlin, Heidelberg. https://doi.org/10.1007/978-3-642-33027-8_2.
Pavlidis, V., & Jiang, M. (Accepted/In press). A Probe Placement Method for Efficient Electromagnetic Attacks. Paper presented at International Conference on Synthesis, Modeling, Analysis and Simulation Methods and Applications to Circuit Design, Erfurt, Germany.https://www.research.manchester.ac.uk/portal/files/191927100/A_Probe_Placement_Method_for_Efficient_Electromagnetic_Attacks_SMACD2021_Minmin.pdf
Chegeni, Vahid & Haj Seyyed Javadi, Hamid & Goudarzi, M. & Rezakhani, Afshin. (2021). Providing a hybrid cryptography algorithm for lightweight authentication protocol in RFID with urban traffic usage case. https://www.researchgate.net/publication/350964538_Providing_a_hybrid_cryptography_algorithm_for_lightweight_authentication_protocol_in_RFID_with_urban_traffic_usage_case/citation/download
François Durvaux and Marc Durvaux. 2020. SCA-Pitaya: A Practical and Affordable Side-Channel Attack Setup for Power Leakage--Based Evaluations. Digital Threats 1, 1, Article 3 (March 2020), 16 pages. DOI:https://doi.org/10.1145/3371393
François Durvaux and Marc Durvaux. 2020. SCA-Pitaya: A Practical and Affordable Side-Channel Attack Setup for Power Leakage--Based Evaluations. Digital Threats 1, 1, Article 3 (March 2020), 16 pages. DOI:https://doi.org/10.1145/3371393
Brian Gladman. Physical Tamper Resistance, Chapter 16 https://www.cl.cam.ac.uk/~rja14/Papers/SEv2-c16.pdf
Mars, Ayoub & Ghandour, Hussam & Adi, Wael. (2021). SRAM-SUC: Ultra-Low Latency Robust Digital PUF.
Written by Dr Katy Win October 2021
PUBLISHED ONLINE 5TH SEPTEMBER 2026 @ 20:26
Comments