NIST CMVP Physical Security Conference Fault Induction Environmental

Agenda • Introduction – Definition of Fault Induction – Types & Uses • Environmental

Fault Induction • Fault Induction: device (crypto module) is forced to miscalculate defined operations,

EFT vs. EFP Environmental Failure Testing Environmental Failure Protections • Combines several types of

EFP Thresholds • • EFP circuit needs to be active when power is applied

Attack Methodology Hire Experts Leverage Known Weaknesses Copyright © 2005 Info. Gard Laboratories Proprietary

EFT Methodology Full Knowledge • Similar process as with attack model • FIPS 140

EFT Conditions • The tester will have access to the production grade version of

EFT – Safety Considerations • The very nature of EFT can be dangerous –

EFT Testing Equipment Environmental chamber: used to modify the cryptographic module’s temperature; notice the

EFT Monitoring Equipment Power Supply Multi-meter PCI Bus Analyzer Serial Bus Analyzer Smart card

Test Reporting Nominal temperature Voltage low threshold Nominal temperature Exceed voltage low threshold 3

Test Reporting Test # Description Temperature (Celsius) Voltage Expected Test Results Observed Test Results

Additional EFT Challenges • Interpretation of the captured data and status outputs: – Low

Sample Published Attacks Attack Description FIPS 140 -2 Optical Fault Induction IC is irradiated

EFT Considerations for FIPS 140 -3 • Incorporate EFT at lower security levels •

References • • • FIPS PUB 140 -2 Optical Fault Induction Attacks: http: //www.

Slides: 25

Download presentation

Agenda • Introduction – Definition of Fault Induction – Types & Uses • Environmental Failure Testing (EFT) – EFP vs EFT – Attack & EFT Testing Methodology • Limited Knowledge • Full Knowledge • Test Conditions & Equipment – Safety Considerations • Test Reporting – Example Test Case Matrix – Example EFT Testing Graph – Reporting Testing Results • Test Challenges • Published Attacks • FIPS 140 -3 Conclusion Copyright © 2005 Info. Gard Laboratories Proprietary 2

Fault Induction • Fault Induction: device (crypto module) is forced to miscalculate defined operations, skip over required operations, and exhibit other erroneous behaviors enabling an attacker (or tester) to gain access to sensitive data or unauthorized control of the device. – Originally used to test products during development to verify that functions could be performed over a wide range of operational parameters (e. g. , temperature, voltage, shock, vibration, clock speed, electro-magnetic, etc. ). Copyright © 2005 Info. Gard Laboratories Proprietary 3

EFT vs. EFP Environmental Failure Testing Environmental Failure Protections • Combines several types of fault – Cryptographic module contains active induction attacks (temp & voltage) mechanisms to monitor and respond to fluctuations (accidental or induced) • Tests performed to ensure that outside normal operating ranges for fluctuations outside normal temperature and voltage operating ranges for temperature and voltage will not compromise – Thresholds are known (e. g when security of cryptographic module tamper response mechanisms will activate) • Point at which the cryptographic module will fail is unknown so – Easier to perform and collect testing more scrutiny is required. data since ranges are known Copyright © 2005 Info. Gard Laboratories Proprietary 4

EFP Thresholds • • EFP circuit needs to be active when power is applied and also when the module is in a dormant state (e. g. with no power applied, during storage, etc. ). Component and module storage & transportation temperature ranges usually extend beyond the normal operating ranges. – Products need to able to be shipped or stored where temperatures can be very cold or very hot (-50 o. C to 125 o. C). • A design and testing challenge to ensure that EFP protections are robust and functional at temperature extremes that push the operating range of the components. 200 150 Module shutdown and zeroization circuit needs to function correctly 100 50 Crypto Module Operating Range Zero -50 Crypto Module Storage and Transport Range EFP Shutdown “Military” Component Operating Range Commercial Component Operating Range The zeroization circuit needs to operate beyond what the temperature that the module is specified to either operate or be stored EFP Zeroization -100 Copyright © 2005 Info. Gard Laboratories Proprietary EFP Zeroization 5

Attack Methodology Hire Experts Leverage Known Weaknesses Copyright © 2005 Info. Gard Laboratories Proprietary Limited Knowledge • Attacker obtains as much design information through data sheets, white papers, marketing literature, employees, etc • Physical samples of the module will be obtained • Attacker will leverage any known weaknesses published in any prior analysis • Attacker creates a specialized attack based on modules characteristics Samples • Depending on the degree of difficulty or reward, “hired experts” may be used Obtain Information 6

EFT Methodology Full Knowledge • Similar process as with attack model • FIPS 140 -2 specifies: – Temperature range to be tested shall be from -100° to +200° Celsius (-150° to +400° Fahrenheit) – Voltage range to be tested shall be from the smallest negative voltage (with respect to ground) that causes the zeroization of the electronic devices or circuitry to the smallest positive voltage (with respect to ground) that causes the zeroization of the electronic devices or circuitry, including reversing the polarity of the voltages. Copyright © 2005 Info. Gard Laboratories Proprietary 7

EFT Conditions • The tester will have access to the production grade version of the module • Additional test jigs are used to enable more convenient access to memory and internal signals for testing purposes • Tester must determine that the testing equipment works correctly. – Performs preliminary tests to exercise the testing equipment • Running a sequence of known commands and inputs • Review log files and other status outputs. • In addition, the tester reviews a log of the equipment calibration and may take additional measures to ensure proper setup. • Is specialized set-up necessary to achieve the desired results (e. g. retrofitting chamber, add’l ventilation, etc) ? Copyright © 2005 Info. Gard Laboratories Proprietary 8

EFT – Safety Considerations • The very nature of EFT can be dangerous – – – High/low temperatures High/low voltages Exploding products Fire Toxic Exhausts etc Copyright © 2005 Info. Gard Laboratories Proprietary • Is the facility where the tests are being performed properly insured to perform EFT testing? • What do you do if the module explodes and someone gets injured? • Are liability issues addressed? • Safety measures for EFT tests: – Face masks (in some cases, a respirator) for smoke/exhaust – Thick gloves to protect hands against hot or freezing components – Smock for body protection against melted parts – Eye goggles – Eye wash station 9

EFT Testing Equipment Environmental chamber: used to modify the cryptographic module’s temperature; notice the monitoring equipment extending out of the chamber’s side Peripheral chamber equipment: liquid nitrogen may be required to bring the temperature down to cold extremes; notice frozen condensation on pipes Copyright © 2005 Info. Gard Laboratories Proprietary 10

EFT Monitoring Equipment Power Supply Multi-meter PCI Bus Analyzer Serial Bus Analyzer Smart card Analyzer Monitoring equipment: a wide variety of monitoring equipment can be used to observe, monitor, and record the activity on each of the physical interfaces supported by the cryptographic module. Copyright © 2005 Info. Gard Laboratories Proprietary 11

Test Reporting Nominal temperature Voltage low threshold Nominal temperature Exceed voltage low threshold 3 Nominal temperature Voltage high threshold 4 Temperature low threshold Nominal voltage 5 Temperature low threshold Voltage low threshold 6 Temperature low threshold Exceed voltage low threshold 7 Exceed temperature low threshold Nominal voltage Nominal temperature Nominal voltage 2 8 Copyright © 2005 Info. Gard Laboratories Proprietary H igh Op 18 15 14 13 16 17 9 Nom inal Tem perature 1 Voltage 2 1 3 12 8 Low Op Test Temperature # 6 5 4 10 7 Low Spec 12 Nominal Voltage High Spec 11

Test Reporting Test # Description Temperature (Celsius) Voltage Expected Test Results Observed Test Results 1 a Nominal temp/ voltage near low threshold 0 5. 75 Module OK 1 b Nominal temp/ voltage near low threshold 8 5. 73 Module OK 1 c Nominal temp/ voltage near low threshold 20 5. 64 Module OK 1 d Nominal temp/ voltage near low threshold 55 5. 61 Module OK Copyright © 2005 Info. Gard Laboratories Proprietary 20

Overview of FIPS 140 -2 Testing Process Product Profile Workshop Step 1 As required Step Optional Services Step 2 Compliance Consulting Documentation Workshop Design Assessment Design Changes * Algorithm Testing Step 3 Source Code Review Step 4 Operational Testing Step 5 Test Report Submittal NIST Report Queue Step 6 Copyright © 2005 Info. Gard Laboratories Proprietary Validation Coordination 21 * Changes done by Vendor

Additional EFT Challenges • Interpretation of the captured data and status outputs: – Low level equipment used to monitor and record module’s physical interfaces such as logic analyzers. – Equipment does not tend to present the captured information in a readily intelligible form • Be prepared to analyze the outputs at a very rudimentary level (e. g. looking at triggers, endless streams of ‘ 0’ and ‘ 1’, etc. ). • Ensure information being gathered can be understood (e. g. via data conversion tables, scripts, etc). • Interpretation of test results: – Module was not designed to withstand the extreme ranges, so it is unknown up front how module will behave during testing. – Can be difficult in some cases to determine module has successfully met the EFT requirements; judgment call made by the accredited laboratory. Copyright © 2005 Info. Gard Laboratories Proprietary 22

Sample Published Attacks Attack Description FIPS 140 -2 Optical Fault Induction IC is irradiated with light to modify bits in CMOS memory Provides the ability to modify executable code and keys in an unauthorized manner Spike Voltage transients on power supply, that could lead to alteration of program execution Could violate the limited operational environment (e. g. untrusted and incorrect program execution) Glitch Modifications of clock signal that could lead to skipping over required operations Could lead to violations of required identification / authentication, self-tests, proper error handling Eddy Current for Magnetic Analysis with Active Sensor (ECMAAS) Electromagnetic induction via electrical coils. “Attacks on the PIN check of a GSM SIM card give the attacker the possibility to extract protected data from the card without knowledge of the PIN Could subvert authentication mechanisms Conducting temperature Modification of ambient temperature may provide the ability to alter contents of RAM or “freeze” the data into memory even once power has been removed Could provide the ability to manipulate sensitive data and also prevent zeroization in the event of memory “freezing Thermal Induced Voltage Alteration Local temperature alteration due to laser irradiation can lead to irregular behavior in module components Could constitute violations of the defined Finite State Machine Single Event Effect Attacks Alpha particle radiation could lead to modification of data in memory Could have similar implications to those already noted above Copyright © 2005 Info. Gard Laboratories Proprietary 23

EFT Considerations for FIPS 140 -3 • Incorporate EFT at lower security levels • Different EFT attacks based on level of security • Add additional fault induction attacks • Revisit absolute temperature/voltage thresholds • Incorporate EFT testing into FIPS 140 -2 Area 11 • Emphasis on tester safety Copyright © 2005 Info. Gard Laboratories Proprietary 24

References • • • FIPS PUB 140 -2 Optical Fault Induction Attacks: http: //www. ftp. cl. cam. ac. uk/ftp/users/rja 14/faultpap 3. pdf Spike Attacks, Glitch Attacks, ECMAAS, Conducting temperature attacks, TIVA, Single Event Effect Attacks: http: //www. silicon-trust. com/pdf/secure_9/15_ifx_laackmann. pdf Optical Attack photo: http: //www. silicontrust. com/pdf/secure_9/15_ifx_laackmann. pdf PCI Bus Analyzer photo: http: //www. corelis. com/products/PCI_Analyzers. htm Serial Bus Analyzer photo: http: //www. yokogawa. com/tm/dl/serialbus/tmserialbus_03. htm Smart Card Analyzer photo: http: //www. securetech-corp. com/class 3150. html Explosion Photo: http: //free. pages. at/mzwirn/matrix/lobby-explosion. jpg Melted Components Photo: http: //amol. org. au/recollections/img/photos/a 2/h 1 - 1374. jpg Copyright © 2005 Info. Gard Laboratories Proprietary 25